GDPR Compliance Tools: Best Practice from RegTech

Abstract

Organisations can be complex entities, performing heterogeneous processing on large volumes of diverse personal data, potentially using outsourced partners or subsidiaries in distributed geographical locations and jurisdictions. Many organisations appoint a Data Protection Officer (DPO) to assist them with their demonstration of compliance with the GDPR Principle of Accountability. The challenge for the DPO is to monitor these complex processing activities and to advise and inform the organisation with regard to the organisations demonstration of compliance with the Principle of Accountability. A review of GDPR compliance software solutions shows that organisations are being greatly challenged in meeting compliance obligations as set out under the GDPR, despite the myriad of software tools available to them. Many organisations continue to take a manual and informal approach to GDPR compliance. Our analysis shows significant gaps on the part of GDPR tools in their ability to demonstrate compliance in that they lack interoperability features, and they are not supported by published methodologies or evidence to support their validity or even utility. In contrast, RegTech has brought great success to financial compliance, using technological solutions to facilitate compliance with, and the monitoring of regulatory requirements. A review of the State of the Art identified the four success features of a RegTech system to be, strong data governance, automation through technology, interoperability of systems and a proactive regulatory framework. This paper outlines a set of requirements for GDPR compliance tools based on the RegTech experience and evaluate how these success features could be applied to improve GDPR compliance. A proof of concept prototype GDPR compliance tool was explored using the four success factors of RegTech, in which RegTech best practice was applied to regulator based self-assessment checklist to establish if the demonstration of GDPR compliance could be improved. The application of a RegTech success factors provides opportunities for demonstrable and validated GDPR compliance, notwithstanding the risk reductions and cost savings that RegTech can deliver and can facilitate organisations in meeting their GDPR compliance obligations.

Data Protection by Design Tool for Automated GDPR Compliance Verification Based on Semantically Modeled Informed Consent

“…The qualitative evaluation was conducted in accordance with the TOMs. This is also a common method of privacy evaluation used by researchers such as Ryan et al [ 6 ] to assess their work using the Irish Data Protection Commission’s self-assessment checklist [ 114 ].…”

“…Ryan et al [ 6 ] present a set of requirements for GDPR compliance based on RegTech [ 14 ] and a prototype implementation of a GDPR compliance verification tool that can assist DPOs in maintaining GDPR accountability. The authors utilize semantics (the Data Privacy Vocabulary (DPV) [ 48 ] and PROV-O [ 49 ] ontologies).…”

“…However, these requirements have also posed significant challenges to companies regarding the automation of compliance verification. Several software tools for GDPR compliance have already been developed that cover some steps required for automated compliance verification (e.g., [ 3 , 4 , 5 , 6 , 7 ]). In most cases, these tools address only a specific subset of the GDPR regulations, such as audit (or auditability) [ 8 ] or only consent management.…”

“…Our tool makes extensive use of semantic technologies, specifically a knowledge graph (KG) and an ontology (both developed in collaboration with legal experts), for representing informed consent as defined by the GDPR. Semantic technology is also regarded as one of the best practices in RegTech [ 14 ] and Ryan et al [ 6 ]. Knowledge graphs, for example, provide a consistent consent representation in a machine-readable format, support data interoperability, and faster and easier knowledge discovery [ 15 ].…”

Support for Enhanced GDPR Accountability with the Common Semantic Model for ROPA (CSM-ROPA)

“…This will enable the organisation to stay informed of risks, enable regular compliance checks, and support accountability, regardless of the form of the data and the tools generating it [4]. Together the requirements for an accountability system based on machine-readable ROPAs were identified as (i) records the information necessary for the completion of an ROPA and support accountability; (ii) supports the digital exchange of data between parties (and systems) such as processors and regulators; (iii) supports automated accountability compliance verification; and (iv) integrates with privacyaware data governance processes and tools [10].…”