Continuous Requirements: An Example Using GDPR

Recently, a stringent set of privacy regulations, the General Data Protection Regulation (GDPR), was enacted in the European Union, which can be considered a privacy non-functional requirement (NFR). As a result, an organization that collects or processes data from European citizens must adhere to the GDPR. Previous studies have shown that compliance to the GDPR poses a number of challenges, which we have confirmed in our own research. In this paper, we describe our ongoing research collaboration with a startup organization that is adopting the GDPR. In addition, during the course of our research, we found that our industry collaborator, practices continuous integration (CI) like many other organizations. The number of organizations adopting CI has increased since Fowler first published his definition of CI. As such, another aspect of our current research is exploring the effects of CI on privacy NFRs and other NFRs. Finally, we describe a design science approach to iteratively learn about industry challenges in GDPR compliance, NFRs in the context of CI, as well as our ongoing work creating a tool to potentially mitigate observed GDPR compliance challenges.