摘要:
The General Data Protection Regulation (GDPR), which came into effect in 2018, regulates how natural or legal persons such as companies, public authorities, agencies, or other bodies process the personal data of natural persons [European Commission, 2016]. As a result, many companies have had to rework their approach to processing personal data, as typical database practices, such as storing data forever or reusing data for different purposes, are at odds with GDPR [Agarwal et al., 2022] [Shastri et al., 2019a] [Shastri et al., 2019b]. The objective of this project is to design and prototype a Data Protection Compliance Tool (DPCT) that supports companies in making their existing database systems GDPR compliant. This is achieved by allowing a user of DPCT to modify an existing database system in such a manner, that the following requirements are fulfilled: 1. Personal data is only processed for legitimate and specific purposes. 2. Personal data is only processed on a legal basis. 3. Personal data is associated with an individual. 4. Personal data is only stored for as long as it is necessary to fulfil a purpose, and it is deleted as soon as that is no longer the case. 5. Operations affecting personal data are logged such that regulators can inspect compli- ance. DPCT supports the fulfillment of these requirements by enabling its users to associate all personal data with metadata that define the purposes for storing it, its associated individual, and when it should be deleted. Existing studies propose much of the functionality needed to fulfill the requirements. Kraska et al. [2019] propose a system that fulfills many of the requirements, but provide only an abstract design and no implementation. The contribution of DPCT is to implement some of this functionality and to combine it with the data vacuuming, presented by Palmer and Srikandarajah [2022], in order to provide companies with a tool that helps them ensure that all personal data in their existing database sys