Data management policies for GDPR compliance at run time

Privacy by Design as dictated by data protection regulationssuch as the GDPR profoundly impacts organizations, not onlyin terms of their data processing activities, business models,organizational structures or functional architectures, but alsoat the level of operational data management. Moreover, datatiers in modern applications are increasingly hybrid in adeployment model (combining both on-premise and third-party cloud resources), and dynamic in their configurations.Instead of hardcoding, we argue in favor of externalizingdata management logic into configurable data storage policiesthat are enforced at run time. Such policies in turn become animportant artifact to demonstrate compliance. We illustratethis vision in the context of an industrial application case, adocument processing SaaS offering.no DOI, no ISBN, not included in proceedings (only published online)status: Published onlin