Building a Data Processing Activities Catalog: Representing Heterogeneous Compliance-related Information for GDPR using DCAT-AP and DPV
File Type:
PDFItem Type:
Conference PaperDate:
2021Author:
Access:
openAccessCitation:
Paul Ryan, Harshvardhan J. Pandit, Rob Brennan, Building a Data Processing Activities Catalog: Representing Heterogeneous Compliance-related Information for GDPR using DCAT-AP and DPV, International Conference on Semantic Systems (SEMANTiCS), Amsterdam, Netherlands, September 2021, 2021Abstract:
This paper describes a new semantic metadata-based approach to describing and integrating diverse data processing activity descriptions gathered from heterogeneous organisational sources such as departments, divisions, and external processors. This information must be collated to assess and document GDPR legal compliance, such as creating a Register of Processing Activities (ROPA). Most GDPR knowledge graph research to date has focused on developing detailed compliance graphs. However, many organisations already have diverse data collection tools for documenting data processing activities, and this heterogeneity is likely to grow in the future. We provide a new approach extending the well-known DCAT-AP standard utilising the data privacy vocabulary (DPV) to express the concepts necessary to complete a ROPA. This approach enables data catalog implementations to merge and federate the metadata for a ROPA without requiring full alignment or merging all the underlying data sources. To show our approach's feasibility, we demonstrate a deployment use case and develop a prototype system based on diverse data processing records and a standard set of SPARQL queries for a Data Protection Officer preparing a ROPA to monitor compliance. Our catalog's key benefits are that it is a lightweight, metadata-level integration point with a low cost of compliance information integration, capable of representing processing activities from heterogeneous sources.
URI:
https://harshp.com/research/publications/047-data-processing-activities-cataloghttp://hdl.handle.net/2262/96594
Sponsor
Grant Number
Irish Research Council (IRC)
GOIPD/2020/790
European Union (EU)
825618
Science Foundation Ireland (SFI)
13/RC/2106_P2
Author's Homepage:
http://people.tcd.ie/pandithj
Author: Pandit, Harshvardhan
Sponsor:
Irish Research Council (IRC)European Union (EU)
Science Foundation Ireland (SFI)
Other Titles:
International Conference on Semantic Systems (SEMANTiCS)Type of material:
Conference PaperURI:
https://harshp.com/research/publications/047-data-processing-activities-cataloghttp://hdl.handle.net/2262/96594
Collections
Availability:
Full text availableKeywords:
Legal compliance, Data governance, GDPRMetadata
Show full item recordLicences: