Towards Evidence-Based Conceptual Modeling for International Data Protection Requirements

Data protection regulations worldwide impose various regulatory requirements on organizations, some overlapping and some differing. Identifying and tracking these requirements is vital for transborder data flows and compliance. Data Protection Impact Assessments (DPIAs) help translate regulations into software specifications and organizational policies, but they often use vague legal language, leading to misunderstandings.Conceptual modeling may support a shared understanding of the domain. Ontologies and modeling methods could help bridge the understanding gap among professionals with different backgrounds in data protection, particularly in transnational realities. Developing these tools requires theoretical knowledge and input from legal practitioners. By identifying common principles and requirements across regulations, practitioners can identify specifications requiring attention for transborder data flows. OBI-PIA aims to tackle this through interdisciplinary research, proposing a regulatory data protection ontology and conceptual modeling method to guide the DPIAs discussion process.This paper presents a work-in-progress (WiP) based on interviews with legal practitioners worldwide. Preliminary results suggest that most regulations promote the OECD privacy principles, and specific requirements such as consent and the conceptualization of personal data. Inspired by the international relations literature, we propose categorizing regulatory data protection requirements into two groups: first-level (common requirements) and second-level (national, different) requirements as first step to star discussing DPIAs in transborder personal data flows. OBI-PIA should help practitioners identify requirements from each level, and discuss in interdiscplinary groups about compliance.