Privdev links personal data types to privacy vocabularies and gdpr rules
PrivDev: Mapping Static-Analysis Data Types to DPV
Cryptography and SecuritySoftware Engineering
Summary
It can be hard to understand how personal data found in computer code relates to official privacy rules. The authors created PrivDev to connect 122 personal-data types identified by a scanner to a standard privacy vocabulary called DPV and to relevant GDPR laws. They matched some types exactly and used a smart language model for the harder cases, checking carefully to make sure these links make sense. By doing this, their work helps clarify privacy information in code and shows where the scanner or vocabularies need improvement.
What this means in practice
- •For privacy engineers: Connect scanned personal-data types in source code to standardized privacy vocabularies to better align software with GDPR compliance.
- •For legal compliance teams: Use mapped data-type labels and GDPR links to interpret personal data treatments in software for privacy audits and risk assessments.
Authors
Simon Bernbeck, Ricardo Ramalho, Matheus Amendoeira, Juliana Alves Pereira
Abstract
Static-analysis scanners can identify personal-data types in source code, but they lack mechanisms to connect these findings to standardized privacy vocabularies. PrivDev maps 122 Bearer CLI data types to Data Privacy Vocabulary Personal Data (DPV-PD) categories and links them to potentially relevant GDPR provisions. Our approach combines deterministic mapping for 43 exact-label matches with a retrieval-grounded Large Language Model (LLM) to resolve the remaining 79 non-trivial mappings. The resulting RDF knowledge graph contains 118 ODRL policy resources that were structurally validated using SHACL. The artifact passed five complementary validation gates that cover structural correctness, query consistency, retrieval quality, LLM-based assessment, and human evaluation. In human evaluation, nine annotators produced 711 judgments, yielding a raw agreement of 0.72, Gwet's AC1 of 0.68, and Gwet's AC2 of 0.88. Our results indicate that the proposed mappings are plausible and reproducible, while also revealing ambiguities in scanner-defined data-type labels and coverage gaps in DPV-PD.