DPCat: Specification for an Interoperable and Machine-Readable Data Processing Catalogue based on GDPR

GDPR requires Data Controllers and Data Protection Officers (DPO) to maintain a Register of Processing Activities (ROPA) as part of overseeing the organisation's compliance processes. The ROPA must include information from heterogeneous sources such as (internal) departments with varying IT systems and (external) Data Processors. Current practices use spreadsheets or proprietary systems that lack machine-readability and interoperability, presenting barriers to automation. We propose the Data Processing Catalogue (DPCat) - a specification based on DCAT-AP and the Data Privacy Vocabulary (DPV) for the representation, collection and transfer of ROPA information, as DCAT catalogues in a machine-readable and interoperable manner. DPCat represents a comprehensive semantic model developed from GDPR's Article 30 and an analysis of the 17 ROPA templates from EU Data Protection Authorities (DPA). To demonstrate the practicality and feasibility of DPCat, we represent the European Data Protection Supervisor's (EDPS) ROPA documents using DPCat, verify it with SHACL to ensure the correctness of information based on legal and contextual requirements, and produce reports and ROPA documents based on DPA templates using SPARQL. DPCat supports a data governance process for data processing compliance to harmonise inputs from heterogeneous sources to produce dynamic documentation that can accommodate differences in regulatory approaches across DPAs and ease investigative burdens toward efficient enforcement.This research has received funding from Uniphar PLC, and the ADAPT Centre for Digital Content Technology which is funded under the SFI Research Centres Programme (Grant 13/RC/2106_P2) and co-funded by the European Regional Development Fund. Harshvardhan J. Pandit has received funding under the Irish Research Council's Government of Ireland Postdoctoral Fellowship Grant#GOIPD/2020/790