Work

A practical solution for modelling GDPR-compliance based on defeasible logic reasoning

Year: 2025

Type: article

Abstract: The General Data Protection Regulation (GDPR), the EU/UK data protection legislation, has necessitated a critical need for compliance modelling to meet its strict and sophisticated requirements. Traditional techniques for modelling security and privacy-related threats fall short of addressing and mitigating the threats of non-compliance. This paper introduces a practical solution to modelling GDPR-compliance based on Defeasible Logic Programming (DeLP), which enhances the robustness and reasoning capabilities of compliance models in real-world scenarios. Furthermore, to overcome the challenges of undecided outputs in logical reasoning, we incorporate explicit priorities for conflicting rules, and suggesting related knowledge for a query in an incomplete knowledge base. To finalise the compliance modelling system, we develop the threat mitigation mechanism that specifies the reasons in case there is a non-compliance threat, along with the suggested actions to mitigate the threat. The application of our approach is demonstrated through a case study on a \textit{Fitbit}use case, focusing on non-compliance threats and resolving "UNDECIDED" query results. Our findings suggest that DeLP provides a flexible and dynamic framework suitable for the GDPR, significantly contributing to the fields of legal reasoning and compliance modelling.

Source: Expert Systems with Applications

DOI: 10.1016/j.eswa.2025.127140

Authors: Naila Azam, Alex Chak, Annalito Michala, Shuja Ansari, Nguyen Binh Truong

Institution: University of Glasgow

Language: English

Topic: Logic, Reasoning, and Knowledge

Subfield: Artificial Intelligence

Field: Computer Science

Domain: Physical Sciences

SDG: Peace, justice, and strong institutions

Open Access status: hybrid

Estimated APC paid: $3,500