DataProVe: Fully Automated Conformance Verification Between Data Protection Policies and System Architectures

Vinh Thong Ta, Max Hashem Eiza

Research output: Contribution to journalArticle (journal)peer-review

96 Downloads (Pure)


Abstract Privacy and data protection by design are relevant parts of the General Data Protection Regulation (GDPR), in which businesses and organisations are encouraged to implement measures at an early stage of the system design phase to fulfil data protection requirements. This paper addresses the policy and system architecture design and propose two variants of privacy policy language and architecture description language, respectively, for specifying and verifying data protection and privacy requirements. In addition, we develop a fully automated algorithm based on logic, for verifying three types of conformance relations (privacy, data protection, and functional conformance) between a policy and an architecture specified in our languages’ variants. Compared to related works, this approach supports a more systematic and fine-grained analysis of the privacy, data protection, and functional properties of a system. Our theoretical methods are then implemented as a software tool called DataProVe and its feasibility is demonstrated based on the centralised and decentralised approaches of COVID-19 contact tracing applications.
Original languageEnglish
Article number86
Pages (from-to)565-585
Number of pages21
JournalProceedings on Privacy Enhancing Technologies (PoPETs)
Issue number1
Early online date20 Nov 2021
Publication statusPublished - 1 Jan 2022


  • Security
  • privacy
  • Verification
  • GDPR


Dive into the research topics of 'DataProVe: Fully Automated Conformance Verification Between Data Protection Policies and System Architectures'. Together they form a unique fingerprint.

Cite this