Using an Enterprise Architecture Model for GDPR Compliance Principles

Abstract

Nowadays, all enterprises must take into account the legal frameworks at all levels of their organization. Over the past two years, the focus has been on the GDPR. This regulation on data and their processing activities impacts on the vision of the enterprise information system. In order to identify these impacts, it is necessary to define an approach to conciliate regulatory and business points of view. Our proposal is to use an enterprise architecture modeling approach to integrate regulatory concerns. This article describes a high-level Archimate model for implementing a GDPR compliance approach.

Massadata-arkkitehtuuri sosiaali- ja terveydenhuollossa: Tiedonhallinnan yleislainsäädännöstä seuraavat vaatimukset henkilötietojen käsittelylle

“…Lainsäädännön laajuuden ja monimutkaisuuden vuoksi yhteinen kansallinen ohjeistus tai viitearkkitehtuuri voisi olla hyödyllinen massadataratkaisuja käyttäville ja sitä suunnitteleville viranomaisille. Tietosuoja-asetuksen soveltamisen tueksi on tehty tällaisia viitearkkitehtuureja [64][65][66][67]. Suomalaisen laajemman lainsäädäntökokonaisuuden vuoksi ohjeistuksen tulisi kuitenkin olla kattavampi.…”

Enterprise architecture management as a solution for addressing general data protection regulation requirements in a big data context: a systematic mapping study

“…This obligation poses major challenges for companies and organisations that work with personal data as its accuracy and comprehensiveness are closely associated with the level of embracement of the data protection principles. Building on the same idea (Blanco-Lainé et al 2020;Burmeister et al 2019Burmeister et al , 2020 argue that EAM can play a key role in the GDPR implementation by addressing the privacy and security related concerns of various classes of stakeholders and by doing so to gain a better understanding of how an effective information governance could be implemented in the organisation. Referring to the size of the organisation, (Rozehnal and Novak 2018) argue that EAM can bring equal benefits to SMEs, where resources for the support of GDPR compliance processes are inheritably limited.…”

Towards the integration of the GDPR in the Unified Software Development Process (S)

“…They focus exclusively on design, that is, they do not account for other development phases. BlancoLainé et al [6] underscore the importance of the GDPR for businesses, which have difficulty understanding the legal requirements. They should take utmost care to ensure compliance, as any mistake can have an impact at all business levels.…”