Privacy Requirements Specification in Agile Software Development : RE’2021 Tutorial

Privacy has become a concern in Agile Software Development (ASD), either to satisfy users' needs or to comply with privacy laws. However, recent studies have shown that ASD approaches still neglect non-functional requirements (NFRs), as is the privacy case. This concern and new data protection laws that came into force recently led companies to face the challenges to understand the laws and to comply with them. In addition, research has shown that many developers do not have sufficient knowledge about how to develop privacy-sensitive software. Motivated by this scenario, this tutorial aims to draw attention to the need to understand privacy from the beginning of the software development lifecycle. Initially, we will present an overview of privacy, as well as several privacy principles. Later, we will show the main data protection laws (In-depth detailing of the General Data Protection Regulation - GDPR). Then, we will discuss how to read and evaluate privacy policies. Finally, we will present an approach for specifying privacy requirements in ASD called Privacy Criteria Method (PCM). At the end of the tutorial, participants will be able to have a critical and technical view of privacy when performing the requirements specification activity.