A practical solution for modelling GDPR-compliance based on defeasible logic reasoning

The General Data Protection Regulation (GDPR), the EU/UK data protection legislation, has necessitated a critical need for compliance modelling to meet its strict and sophisticated requirements. Traditional techniques for modelling security and privacy-related threats fall short of addressing and mitigating the threats of non-compliance. This paper introduces a practical solution to modelling GDPR-compliance based on Defeasible Logic Programming (DeLP), which enhances the robustness and reasoning capabilities of compliance models in real-world scenarios. Furthermore, to overcome the challenges of UNDECIDED query outputs in logical reasoning, we incorporate explicit priorities for conflicting rules and suggest related knowledge for a query in an incomplete knowledge base. To finalize the compliance modelling system, we develop the threat mitigation mechanism that specifies the reasons in case there is a non-compliance threat, along with the suggested actions to mitigate the threats. The application of our approach is demonstrated through a case study on Fitbit , health tracking devices, focusing on non-compliance threats and resolving ”UNDECIDED” query results. Our findings show that the inference engine efficiently identifies non-compliance threats, handles UNDECIDED query results, and suggests appropriate threat mitigation measures. • Developed a knowledge base using Defeasible Logic Programming (DeLP) for GDPR compliance. • Integrated a DeLP-based reasoning mechanism to identify and mitigate non-compliance threats. • Implemented handlers for resolving contradictions in the knowledge base. • Integrated mechanisms to address incompleteness in the knowledge base. • Validated the approach with a Fitbit case study addressing non-compliance threats.