Identifying GDPR-Critical Tasks in Business Process Descriptions

Abstract Compliance with data protection regulations is a crucial obligation for organizations, as violations can result in substantial regulatory fines. In the European Union, the General Data Protection Regulation defines personal data and establishes specific requirements for its protection. To ensure compliance, organizations must identify all tasks in their business processes whose execution involves personal data and establish appropriate security measures whenever changes in business processes, regulations, or technologies occur. Manual identification can be labor-intensive and error-prone, especially in large organizations where business processes change frequently. Textual business process descriptions, such as work instructions, provide valuable insights into organizational processes and the types of data involved. They can be used as the basis for an approach to automatically identify GDPR-critical tasks, i.e., tasks in which personal data is transmitted, stored, or otherwise processed. However, existing data sets of business process descriptions are too small to effectively train current natural language processing models. Therefore, this paper uses large language models to create a new synthetic data set of business process descriptions. Subsequently, several BERT variants are fine-tuned to automatically identify GDPR-critical tasks. An evaluation of the data set shows that the generated business process descriptions are of sufficient quality and useful for model training. The following evaluation of the proposed approach demonstrates strong performance in identifying GDPR-critical tasks. Hence, the approach supports regulatory compliance decisions by identifying affected tasks, thereby facilitating the targeted implementation of compliance measures.