Since the introduction of the General Data Protection Regulation (GDPR) in 2018, companies have been faced with the challenge of integrating data protection requirements into their software development processes - under the risk of significant fines. The GDPR affects various phases of the software development lifecycle and places new demands on requirements engineering (requirements management). The enforcement of GDPR has steadily increased in recent years. In the past year alone, the number of fines rose by 32.4%, totaling 2,086, while the average fine reached EUR 2,142,712, according to the GDPR Enforcement Tracker Report 2024.

The regulation obliges both software developers and software users to implement effective measures to protect personal data. However, regulations such as the GDPR are written in legal jargon and require additional effort to be translated into concrete requirements. For this reason, software engineers find it difficult to derive implementable software requirements from the GDPR. It is particularly challenging to identify the relevant aspects and incorporate them into the specifications of the solution architecture.

We are currently investigating the methods for requirements and system specification for GDPR compliance in an ongoing study in the Requirements Engineering competence field in order to support companies in systematizing their processes. In particular, we want to answer the question of which main objectives and aspects the requirements and system specification methods must address in order to ensure compliance with the GDPR.

In cooperation with the Bavarian Center for Software Innovation

The study includes the following activities:

• Interviews to gather data on current requirements and system specification practices (conducted one-on-one, either online or offline, lasting approximately 45–55 minutes).
• Hands-on exercises to test our proposed method for requirements and system specification, followed by group discussions and experience sharing on existing methods (group activities conducted online or offline, lasting approximately 1 to 1.5 hours).