Ryan, Paul
ORCID: 0000-0003-0770-2737
(2025)
ERoPA: A Machine-Readable Approach to the Record of Processing Activities (RoPA) for GDPR Compliance.
PhD thesis, Dublin City University.
Abstract
The General Data Protection Regulation (GDPR) mandates that organisations keep a Record of Processing Activities (RoPA) and ensure compliance. The RoPA should include details on processing personal data from internal departments with diverse IT systems and external data processors. Current practices rely on spreadsheets or proprietary systems, which lack machine readability and interoperability, creating obstacles to automation. Regulators report that organisations face challenges in maintaining an accurate and up-to-date RoPA.
This thesis defines an approach to supporting ‘Electronic Records of Processing Activities’ (ERoPA) to help organisations comply with the GDPR Accountability Principle. The “ERoPA Approach” facilitates the collection, representation, transfer, and review of information to support organisational GDPR compliance through the automation of RoPA processes based on stakeholder requirements.
Using the Action Design Research (ADR) methodology, fourteen stakeholder requirements for the ERoPA Approach were identified. The ERoPA Approach was developed iteratively through ADR to provide: (i) an ontology to support the representation of RoPAs based on a survey of RoPA templates published by GDPR regulators, (ii) an interoperable machine-readable approach for the collection and transfer of RoPA information, and (iii) queries to support typical compliance tasks and (iv) deployment guidelines for practical implementations based on a case study in a real organisation where observations were gathered, and the opinions of data protection experts were consulted.
The main contribution of this thesis is the ERoPA Approach, which enhances GDPR accountability by facilitating the collection, representation, transfer, and review of RoPA information exchanged among stakeholders in data processing chains. The ERoPA Approach enables sharing GDPR accountability information with regulators and certification bodies, significantly improving the visibility and efficiency of organisational accountability practices. Additionally, it provides tools to support GDPR compliance automation. A minor contribution of this research is the extension of the W3C Community Standard, Data Privacy Vocabulary (DPV), to represent RoPAs.
Metadata
| Item Type: | Thesis (PhD) |
|---|---|
| Date of Award: | 4 December 2025 |
| Refereed: | No |
| Supervisor(s): | Crane, Martin, Pandit, Harshvardhan and Brennan, Rob |
| Uncontrolled Keywords: | GDPR, Data Protection Officer, RoPA, GDPR Compliance, Semantic Web and Recording of Processing Activities, RegTech |
| Subjects: | Computer Science > Software engineering Computer Science > Information storage and retrieval systems |
| DCU Faculties and Centres: | DCU Faculties and Schools > Faculty of Engineering and Computing > School of Computing DCU Faculties and Schools Research Institutes and Centres > ADAPT |
| Use License: | This item is licensed under a Creative Commons Attribution-NonCommercial-No Derivative Works 4.0 License. View License |
| ID Code: | 31963 |
| Deposited On: | 14 Apr 2026 13:53 by Martin Crane . Last Modified 14 Apr 2026 13:53 |
Documents
Full text available as:
Preview |
PDF (Paul Ryan PhD Thesis)
- Requires a PDF viewer such as GSview, Xpdf or Adobe Acrobat Reader
Creative Commons: Attribution-Noncommercial-No Derivative Works 4.0 4MB |
Downloads
Downloads
Downloads per month over past year
Archive Staff Only: edit this record