Translating Data Protection into Software Requirements

With the growth of data processing and digitalisation in many environments, data protection is also growing more and more important. This is for example reflected by the General Data Protection Regulation (GDPR) which came into effect in May 2018 and defines what organisations need to do to protect individuals and their personal data. This paper provides a summary of the main data protection concepts, using GDPR as an example, and from these derives the resulting software requirements that apply to software systems which process private data within the European Union (and to some extent beyond). This way, the paper supports software developers as well as requirements analysts in their task of identifying and defining the data protection requirements, even though they will have to be adapted and additional detail provided for any specific case.