Towards a GDPR-compliant cloud architecture with data privacy controlled through sticky policies.

Area of Science:

• Computer Science
• Software Engineering
• Cloud Computing

Background:

• Data privacy presents significant challenges for system architects, particularly in cloud environments subject to regulations like the General Data Protection Regulation (GDPR).
• Ensuring compliance with data protection laws is critical for cloud providers to maintain user trust and avoid legal penalties.

Purpose of the Study:

• To propose a novel cloud architecture designed to comply with the General Data Protection Regulation (GDPR).
• To provide cloud providers with a framework for managing data privacy and tracking within cloud environments.

Main Methods:

• Utilized model-driven engineering techniques for cloud architecture design and interaction analysis.
• Developed the Model-Driven Cloud Toolkit (MDCT) framework, incorporating a Unified Modeling Language (UML) profile.
• Employed Object Constraint Language (OCL) rules for model validation and ensuring required properties are met.

Main Results:

• The MDCT framework enables the definition and validation of GDPR-compliant cloud scenarios.
• The proposed architecture integrates data privacy and tracking mechanisms, including sticky policies for access control.
• Validation through OCL rules confirms adherence to key GDPR articles such as user consent, purpose of access, and data transparency.

Conclusions:

• The MDCT framework offers a robust solution for designing and validating GDPR-compliant cloud architectures.
• The integration of sticky policies and OCL rules effectively addresses data privacy and tracking requirements.
• This approach facilitates secure and transparent data management in cloud environments, aiding regulatory compliance.