Using enterprise architecture models for creating the record of processing activities (Art. 30 GDPR)

Dominik Huth; Ahmet Tanakol; Florian Matthes

doi:10.1109/EDOC.2019.00021

Using enterprise architecture models for creating the record of processing activities (Art. 30 GDPR)

Dominik Huth, Ahmet Tanakol, Florian Matthes

Informatics 19 - Chair of Software Engineering for Business Information Systems

Technical University of Munich

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

11 Scopus citations

Abstract

The record of processing activities (RPA) is a central document in demonstrating compliance with the General Data Protection Regulation (GDPR). Article 30 of the GDPR specifies the information that has to be made available to the supervisory authority upon request. Currently, data protection management experts conduct their own data collection and maintain isolated RPAs. We show how existing Enterprise Architecture models can be augmented with the necessary information to maintain and generate an RPA. We evaluate the completeness and usefulness of the approach together with data protection management experts.

Original language	English
Title of host publication	Proceedings - 2019 IEEE 23rd International Enterprise Distributed Object Computing Conference, EDOC 2019
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	98-104
Number of pages	7
ISBN (Electronic)	9781728127026
DOIs	https://doi.org/10.1109/EDOC.2019.00021
State	Published - Oct 2019
Event	23rd IEEE International Enterprise Distributed Object Computing Conference, EDOC 2019 - Paris, France Duration: 28 Oct 2019 → 31 Oct 2019

Publication series

Name	Proceedings - 2019 IEEE 23rd International Enterprise Distributed Object Computing Conference, EDOC 2019

Conference

Conference	23rd IEEE International Enterprise Distributed Object Computing Conference, EDOC 2019
Country/Territory	France
City	Paris
Period	28/10/19 → 31/10/19

Keywords

ArchiMate
Data protection
Enterprise Architecture Management
GDPR
RPA
Record of processing activities

Access to Document

10.1109/EDOC.2019.00021

Cite this

Huth, D., Tanakol, A., & Matthes, F. (2019). Using enterprise architecture models for creating the record of processing activities (Art. 30 GDPR). In Proceedings - 2019 IEEE 23rd International Enterprise Distributed Object Computing Conference, EDOC 2019 (pp. 98-104). Article 8944938 (Proceedings - 2019 IEEE 23rd International Enterprise Distributed Object Computing Conference, EDOC 2019). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/EDOC.2019.00021

Huth, Dominik ; Tanakol, Ahmet ; Matthes, Florian. / Using enterprise architecture models for creating the record of processing activities (Art. 30 GDPR). Proceedings - 2019 IEEE 23rd International Enterprise Distributed Object Computing Conference, EDOC 2019. Institute of Electrical and Electronics Engineers Inc., 2019. pp. 98-104 (Proceedings - 2019 IEEE 23rd International Enterprise Distributed Object Computing Conference, EDOC 2019).

@inproceedings{f6b5b42e90764b6ea580cbfba2c0a7de,

title = "Using enterprise architecture models for creating the record of processing activities (Art. 30 GDPR)",

abstract = "The record of processing activities (RPA) is a central document in demonstrating compliance with the General Data Protection Regulation (GDPR). Article 30 of the GDPR specifies the information that has to be made available to the supervisory authority upon request. Currently, data protection management experts conduct their own data collection and maintain isolated RPAs. We show how existing Enterprise Architecture models can be augmented with the necessary information to maintain and generate an RPA. We evaluate the completeness and usefulness of the approach together with data protection management experts.",

keywords = "ArchiMate, Data protection, Enterprise Architecture Management, GDPR, RPA, Record of processing activities",

author = "Dominik Huth and Ahmet Tanakol and Florian Matthes",

note = "Publisher Copyright: {\textcopyright} 2019 IEEE.; 23rd IEEE International Enterprise Distributed Object Computing Conference, EDOC 2019 ; Conference date: 28-10-2019 Through 31-10-2019",

year = "2019",

month = oct,

doi = "10.1109/EDOC.2019.00021",

language = "English",

series = "Proceedings - 2019 IEEE 23rd International Enterprise Distributed Object Computing Conference, EDOC 2019",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "98--104",

booktitle = "Proceedings - 2019 IEEE 23rd International Enterprise Distributed Object Computing Conference, EDOC 2019",

}

Huth, D, Tanakol, A & Matthes, F 2019, Using enterprise architecture models for creating the record of processing activities (Art. 30 GDPR). in Proceedings - 2019 IEEE 23rd International Enterprise Distributed Object Computing Conference, EDOC 2019., 8944938, Proceedings - 2019 IEEE 23rd International Enterprise Distributed Object Computing Conference, EDOC 2019, Institute of Electrical and Electronics Engineers Inc., pp. 98-104, 23rd IEEE International Enterprise Distributed Object Computing Conference, EDOC 2019, Paris, France, 28/10/19. https://doi.org/10.1109/EDOC.2019.00021

Using enterprise architecture models for creating the record of processing activities (Art. 30 GDPR). / Huth, Dominik; Tanakol, Ahmet; Matthes, Florian.
Proceedings - 2019 IEEE 23rd International Enterprise Distributed Object Computing Conference, EDOC 2019. Institute of Electrical and Electronics Engineers Inc., 2019. p. 98-104 8944938 (Proceedings - 2019 IEEE 23rd International Enterprise Distributed Object Computing Conference, EDOC 2019).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Using enterprise architecture models for creating the record of processing activities (Art. 30 GDPR)

AU - Huth, Dominik

AU - Tanakol, Ahmet

AU - Matthes, Florian

PY - 2019/10

Y1 - 2019/10

N2 - The record of processing activities (RPA) is a central document in demonstrating compliance with the General Data Protection Regulation (GDPR). Article 30 of the GDPR specifies the information that has to be made available to the supervisory authority upon request. Currently, data protection management experts conduct their own data collection and maintain isolated RPAs. We show how existing Enterprise Architecture models can be augmented with the necessary information to maintain and generate an RPA. We evaluate the completeness and usefulness of the approach together with data protection management experts.

AB - The record of processing activities (RPA) is a central document in demonstrating compliance with the General Data Protection Regulation (GDPR). Article 30 of the GDPR specifies the information that has to be made available to the supervisory authority upon request. Currently, data protection management experts conduct their own data collection and maintain isolated RPAs. We show how existing Enterprise Architecture models can be augmented with the necessary information to maintain and generate an RPA. We evaluate the completeness and usefulness of the approach together with data protection management experts.

KW - ArchiMate

KW - Data protection

KW - Enterprise Architecture Management

KW - GDPR

KW - RPA

KW - Record of processing activities

UR - http://www.scopus.com/inward/record.url?scp=85078250444&partnerID=8YFLogxK

U2 - 10.1109/EDOC.2019.00021

DO - 10.1109/EDOC.2019.00021

M3 - Conference contribution

AN - SCOPUS:85078250444

T3 - Proceedings - 2019 IEEE 23rd International Enterprise Distributed Object Computing Conference, EDOC 2019

SP - 98

EP - 104

BT - Proceedings - 2019 IEEE 23rd International Enterprise Distributed Object Computing Conference, EDOC 2019

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 23rd IEEE International Enterprise Distributed Object Computing Conference, EDOC 2019

Y2 - 28 October 2019 through 31 October 2019

ER -

Huth D, Tanakol A, Matthes F. Using enterprise architecture models for creating the record of processing activities (Art. 30 GDPR). In Proceedings - 2019 IEEE 23rd International Enterprise Distributed Object Computing Conference, EDOC 2019. Institute of Electrical and Electronics Engineers Inc. 2019. p. 98-104. 8944938. (Proceedings - 2019 IEEE 23rd International Enterprise Distributed Object Computing Conference, EDOC 2019). doi: 10.1109/EDOC.2019.00021

Using enterprise architecture models for creating the record of processing activities (Art. 30 GDPR)

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this