# The General Data Protection Regulation: Requirements, Architectures, and Constraints

## TL;DR

This paper explores the practical implications of GDPR on requirements engineering and software architectures, focusing on constraints faced by SMEs and proposing architecture solutions compliant with GDPR.

## Contribution

It identifies nine practical constraints and nine regulatory requirements from GDPR, and presents an architecture implementation that meets these constraints and requirements.

## Key findings

- Nine constraints for SMEs implementing GDPR solutions
- Nine GDPR-derived requirements for software architectures
- An architecture implementation compliant with GDPR constraints and requirements

## Abstract

The General Data Protection Regulation (GDPR) in the European Union is the most famous recently enacted privacy regulation. Despite of the regulation's legal, political, and technological ramifications, relatively little research has been carried out for better understanding the GDPR's practical implications for requirements engineering and software architectures. Building on a grounded theory approach with close ties to the Finnish software industry, this paper contributes to the sealing of this gap in previous research. Three questions are asked and answered in the context of software development organizations. First, the paper elaborates nine practical constraints under which many small and medium-sized enterprises (SMEs) often operate when implementing solutions that address the new regulatory demands. Second, the paper elicits nine regulatory requirements from the GDPR for software architectures. Third, the paper presents an implementation for a software architecture that complies both with the requirements elicited and the constraints elaborated.