PrivDev: Mapping Static-Analysis Data Types to DPV
Resumo
Static-analysis scanners can identify personal-data types in source code, but they lack mechanisms to connect these findings to standardized privacy vocabularies. PrivDev maps 122 Bearer CLI data types to Data Privacy Vocabulary Personal Data (DPV-PD) categories and links them to potentially relevant GDPR provisions. Our approach combines deterministic mapping for 43 exact-label matches with a retrieval-grounded Large Language Model (LLM) to resolve the remaining 79 non-trivial mappings. The resulting RDF knowledge graph contains 118 ODRL policy resources that were structurally validated using SHACL. The artifact passed five complementary validation gates that cover structural correctness, query consistency, retrieval quality, LLM-based assessment, and human evaluation. In human evaluation, nine annotators produced 711 judgments, yielding a raw agreement of 0.72, Gwet’s AC1 of 0.68, and Gwet’s AC2 of 0.88. Our results indicate that the proposed mappings are plausible and reproducible, while also revealing ambiguities in scanner-defined data-type labels and coverage gaps in DPV-PD.
Palavras-chave:
Static Analysis, Privacy Engineering, LLMs, DPV, GDPR
Referências
C. Baramashetru, P. Giannini, S. Tarifa, and Olaf Owe. 2025. A Type System for Data Privacy Compliance in Active Object Languages. Art Sci. Eng. Program. 10 (2025). DOI: 10.22152/programming-journal.org/2025/10/18
Bearer. 2026. Bearer CLI Documentation. [link].
Simon Bernbeck, Ricardo Ramalho, Matheus Amendoeira, and Juliana Alves Pereira. 2026. PrivDev Supplementary Material. [link]. Accessed on: 10/08/2026.
Beatriz Esteves and Víctor Rodríguez-Doncel. 2024. Analysis of ontologies and policy languages to represent information flows in GDPR. Semantic Web 15, 3 (2024), 709–743.
Alvan R. Feinstein and Domenic V. Cicchetti. 1990. High Agreement but Low Kappa: I. The Problems of Two Paradoxes. Journal of Clinical Epidemiology 43, 6 (1990), 543–549. DOI: 10.1016/0895-4356(90)90158-L
Mafalda Ferreira, Tiago Brito, J. Santos, and Nuno Santos. 2023. RuleKeeper: GDPR-Aware Personal Data Compliance for Web Frameworks. 2023 IEEE Symposium on Security and Privacy (SP) (2023), 2817–2834. DOI: 10.1109/sp46215.2023.10179395
Kilem L. Gwet. 2008. Computing Inter-Rater Reliability and Its Variance in the Presence of High Agreement. Brit. J. Math. Statist. Psych. 61, 1 (2008), 29–48. DOI: 10.1348/000711006X126600
Kilem L. Gwet. 2014. Handbook of Inter-Rater Reliability (4th ed.). Advanced Analytics, LLC, Gaithersburg, MD, USA.
I. Hadar et al. 2018. Privacy by Designers: Software Developers’ Privacy Mindset. Empirical Software Engineering 23, 1 (2018), 259–289.
Steve Harris and Andy Seaborne. 2013. SPARQL 1.1 Query Language. W3C Recommendation, [link].
A. R. Hevner, S. T. March, J. Park, and S. Ram. 2004. Design Science in Information Systems Research. MIS Quarterly 28, 1 (2004), 75–105.
Harshvardhan J. Pandit, Beatriz Esteves, Georg P. Krog, Paul Ryan, Delaram Golpayegani, and Julian Flake. 2024. Data Privacy Vocabulary (DPV)–Version 2.0. In International Semantic Web Conference. Springer, 171–193.
Jeff Johnson, Matthijs Douze, and Hervé Jégou. 2019. Billion-Scale Similarity Search with GPUs. IEEE Transactions on Big Data 7, 3 (2019), 535–547. DOI: 10.1109/TBDATA.2019.2921572
Mugdha Khedkar. 2023. Static Analysis for Android GDPR Compliance Assurance. In 2023 IEEE/ACM 45th International Conference on Software Engineering: Companion Proceedings (ICSE-Companion). 197–199. DOI: 10.1109/icse-companion58688.2023.00054
Mugdha Khedkar and Eric Bodden. 2024. Toward an Android Static Analysis Approach for Data Protection. In 2024 IEEE/ACM 11th International Conference on Mobile Software Engineering and Systems (MOBILESoft). 65–68. DOI: 10.1145/3647632.3651389
Mugdha Khedkar, Michael Schlichtig, Nihad Atakishiyev, and Eric Bodden. 2026. Between law and code: challenges and opportunities for automating privacy assessments. Automated Software Engineering 33, 2 (Feb. 2026), 56. DOI: 10.1007/s10515-026-00601-4
Klaus Krippendorff. 2004. Reliability in Content Analysis: Some Common Misconceptions and Recommendations. Human Communication Research 30, 3 (2004), 411–433. DOI: 10.1111/j.1468-2958.2004.tb00738.x
Aryely Matos, Mario Patrício, Maria Isabel Nicolau, Edna Dias Canedo, Juliana Alves Pereira, and Anderson Uchôa. 2025. Data Privacy in Software Practice: Brazilian Developers’ Perspectives. Journal of Internet Services and Applications 16, 1 (Jun. 2025), 291–311. DOI: 10.5753/jisa.2025.5302
H. J. Pandit and B. Esteves. 2024. Enhancing Data Use Ontology (DUO) for Health-Data Sharing by Extending it with ODRL and DPV. Semantic Web Journal 15, 4 (2024), 1473–1498. DOI: 10.3233/SW-243583
María Poveda-Villalón, Asunción Gómez-Pérez, and Mari Carmen Suárez-Figueroa. 2014. OOPS! (OntOlogy Pitfall Scanner!): An On-line Tool for Ontology Evaluation. International Journal on Semantic Web and Information Systems 10, 2 (2014), 7–34. DOI: 10.4018/ijswis.2014040102
Huaijin Ran, Haoyi Zhang, and Xunzhu Tang. 2025. GDPR-Bench-Android: A Benchmark for Evaluating Automated GDPR Compliance Detection in Android. ArXiv abs/2511.00619 (2025). DOI: 10.48550/arxiv.2511.00619
Fabio Rovai. 2026. Open Ontologies: Tool-Augmented Ontology Engineering with Stable Matching Alignment. arXiv preprint arXiv:2605.09184. DOI: 10.48550/arXiv.2605.09184
A. Senarath and N. A. G. Arachchilage. 2018. Why Developers Cannot Embed Privacy into Software Systems: An Empirical Investigation. In Proceedings of the Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018). USENIX Association, Baltimore, MD, USA, 211–231.
M. C. Suárez-Figueroa, A. Gómez-Pérez, E. Motta, and A. Gangemi (Eds.). 2012. Ontology Engineering in a Networked World. Springer, Berlin, Heidelberg. doi:10 .1007/978-3-642-24794-1
Zhi Rui Tam, Cheng-Kuang Wu, Yi-Lin Tsai, Chieh-Yen Lin, Hung-yi Lee, and Yun-Nung Chen. 2024. Let Me Speak Freely? A Study on the Impact of Format Restrictions on Performance of Large Language Models. arXiv preprint arXiv:2408.02442. DOI: 10.48550/arXiv.2408.02442
Shukun Tokas, Olaf Owe, and Toktam Ramezanifarkhani. 2021. Static checking of GDPR-related privacy compliance for object-oriented distributed systems. J. Log. Algebraic Methods Program. 125 (2021), 100733. DOI: 10.1016/j.jlamp.2021.100733
J. Venable, J. Pries-Heje, and R. Baskerville. 2016. FEDS: A Framework for Evaluation in Design Science Research. European Journal of Information Systems 25, 1 (2016), 77–89.
W3C. 2017. SHACL – Shapes Constraint Language. [link].
W3C. 2021. ODRL Information Model 2.2. [link].
W3C Data Privacy Vocabularies and Controls Community Group. 2025. Data Privacy Vocabulary (DPV). [link].
W3C Data Privacy Vocabularies and Controls Community Group. 2025. Rules — Permission, Prohibition, and Obligation in DPV. [link]. Accessed: 16/08/2026.
Jialin Yang, Dongfu Jiang, Lipeng He, Sherman Siu, Yuxuan Zhang, Disen Liao, Zhuofeng Li, Huaye Zeng, Yiming Jia, Haozhe Wang, Benjamin Schneider, Chi Ruan, Wentao Ma, Zhiheng Lyu, Yifei Wang, Yi Lu, Quy Duc Do, Ziyan Jiang, Ping Nie, and Wenhu Chen. 2025. StructEval: Benchmarking LLMs’ Capabilities to Generate Structural Outputs. arXiv preprint arXiv:2505.20139. DOI: 10.48550/arXiv.2505.20139
Bearer. 2026. Bearer CLI Documentation. [link].
Simon Bernbeck, Ricardo Ramalho, Matheus Amendoeira, and Juliana Alves Pereira. 2026. PrivDev Supplementary Material. [link]. Accessed on: 10/08/2026.
Beatriz Esteves and Víctor Rodríguez-Doncel. 2024. Analysis of ontologies and policy languages to represent information flows in GDPR. Semantic Web 15, 3 (2024), 709–743.
Alvan R. Feinstein and Domenic V. Cicchetti. 1990. High Agreement but Low Kappa: I. The Problems of Two Paradoxes. Journal of Clinical Epidemiology 43, 6 (1990), 543–549. DOI: 10.1016/0895-4356(90)90158-L
Mafalda Ferreira, Tiago Brito, J. Santos, and Nuno Santos. 2023. RuleKeeper: GDPR-Aware Personal Data Compliance for Web Frameworks. 2023 IEEE Symposium on Security and Privacy (SP) (2023), 2817–2834. DOI: 10.1109/sp46215.2023.10179395
Kilem L. Gwet. 2008. Computing Inter-Rater Reliability and Its Variance in the Presence of High Agreement. Brit. J. Math. Statist. Psych. 61, 1 (2008), 29–48. DOI: 10.1348/000711006X126600
Kilem L. Gwet. 2014. Handbook of Inter-Rater Reliability (4th ed.). Advanced Analytics, LLC, Gaithersburg, MD, USA.
I. Hadar et al. 2018. Privacy by Designers: Software Developers’ Privacy Mindset. Empirical Software Engineering 23, 1 (2018), 259–289.
Steve Harris and Andy Seaborne. 2013. SPARQL 1.1 Query Language. W3C Recommendation, [link].
A. R. Hevner, S. T. March, J. Park, and S. Ram. 2004. Design Science in Information Systems Research. MIS Quarterly 28, 1 (2004), 75–105.
Harshvardhan J. Pandit, Beatriz Esteves, Georg P. Krog, Paul Ryan, Delaram Golpayegani, and Julian Flake. 2024. Data Privacy Vocabulary (DPV)–Version 2.0. In International Semantic Web Conference. Springer, 171–193.
Jeff Johnson, Matthijs Douze, and Hervé Jégou. 2019. Billion-Scale Similarity Search with GPUs. IEEE Transactions on Big Data 7, 3 (2019), 535–547. DOI: 10.1109/TBDATA.2019.2921572
Mugdha Khedkar. 2023. Static Analysis for Android GDPR Compliance Assurance. In 2023 IEEE/ACM 45th International Conference on Software Engineering: Companion Proceedings (ICSE-Companion). 197–199. DOI: 10.1109/icse-companion58688.2023.00054
Mugdha Khedkar and Eric Bodden. 2024. Toward an Android Static Analysis Approach for Data Protection. In 2024 IEEE/ACM 11th International Conference on Mobile Software Engineering and Systems (MOBILESoft). 65–68. DOI: 10.1145/3647632.3651389
Mugdha Khedkar, Michael Schlichtig, Nihad Atakishiyev, and Eric Bodden. 2026. Between law and code: challenges and opportunities for automating privacy assessments. Automated Software Engineering 33, 2 (Feb. 2026), 56. DOI: 10.1007/s10515-026-00601-4
Klaus Krippendorff. 2004. Reliability in Content Analysis: Some Common Misconceptions and Recommendations. Human Communication Research 30, 3 (2004), 411–433. DOI: 10.1111/j.1468-2958.2004.tb00738.x
Aryely Matos, Mario Patrício, Maria Isabel Nicolau, Edna Dias Canedo, Juliana Alves Pereira, and Anderson Uchôa. 2025. Data Privacy in Software Practice: Brazilian Developers’ Perspectives. Journal of Internet Services and Applications 16, 1 (Jun. 2025), 291–311. DOI: 10.5753/jisa.2025.5302
H. J. Pandit and B. Esteves. 2024. Enhancing Data Use Ontology (DUO) for Health-Data Sharing by Extending it with ODRL and DPV. Semantic Web Journal 15, 4 (2024), 1473–1498. DOI: 10.3233/SW-243583
María Poveda-Villalón, Asunción Gómez-Pérez, and Mari Carmen Suárez-Figueroa. 2014. OOPS! (OntOlogy Pitfall Scanner!): An On-line Tool for Ontology Evaluation. International Journal on Semantic Web and Information Systems 10, 2 (2014), 7–34. DOI: 10.4018/ijswis.2014040102
Huaijin Ran, Haoyi Zhang, and Xunzhu Tang. 2025. GDPR-Bench-Android: A Benchmark for Evaluating Automated GDPR Compliance Detection in Android. ArXiv abs/2511.00619 (2025). DOI: 10.48550/arxiv.2511.00619
Fabio Rovai. 2026. Open Ontologies: Tool-Augmented Ontology Engineering with Stable Matching Alignment. arXiv preprint arXiv:2605.09184. DOI: 10.48550/arXiv.2605.09184
A. Senarath and N. A. G. Arachchilage. 2018. Why Developers Cannot Embed Privacy into Software Systems: An Empirical Investigation. In Proceedings of the Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018). USENIX Association, Baltimore, MD, USA, 211–231.
M. C. Suárez-Figueroa, A. Gómez-Pérez, E. Motta, and A. Gangemi (Eds.). 2012. Ontology Engineering in a Networked World. Springer, Berlin, Heidelberg. doi:10 .1007/978-3-642-24794-1
Zhi Rui Tam, Cheng-Kuang Wu, Yi-Lin Tsai, Chieh-Yen Lin, Hung-yi Lee, and Yun-Nung Chen. 2024. Let Me Speak Freely? A Study on the Impact of Format Restrictions on Performance of Large Language Models. arXiv preprint arXiv:2408.02442. DOI: 10.48550/arXiv.2408.02442
Shukun Tokas, Olaf Owe, and Toktam Ramezanifarkhani. 2021. Static checking of GDPR-related privacy compliance for object-oriented distributed systems. J. Log. Algebraic Methods Program. 125 (2021), 100733. DOI: 10.1016/j.jlamp.2021.100733
J. Venable, J. Pries-Heje, and R. Baskerville. 2016. FEDS: A Framework for Evaluation in Design Science Research. European Journal of Information Systems 25, 1 (2016), 77–89.
W3C. 2017. SHACL – Shapes Constraint Language. [link].
W3C. 2021. ODRL Information Model 2.2. [link].
W3C Data Privacy Vocabularies and Controls Community Group. 2025. Data Privacy Vocabulary (DPV). [link].
W3C Data Privacy Vocabularies and Controls Community Group. 2025. Rules — Permission, Prohibition, and Obligation in DPV. [link]. Accessed: 16/08/2026.
Jialin Yang, Dongfu Jiang, Lipeng He, Sherman Siu, Yuxuan Zhang, Disen Liao, Zhuofeng Li, Huaye Zeng, Yiming Jia, Haozhe Wang, Benjamin Schneider, Chi Ruan, Wentao Ma, Zhiheng Lyu, Yifei Wang, Yi Lu, Quy Duc Do, Ziyan Jiang, Ping Nie, and Wenhu Chen. 2025. StructEval: Benchmarking LLMs’ Capabilities to Generate Structural Outputs. arXiv preprint arXiv:2505.20139. DOI: 10.48550/arXiv.2505.20139
Publicado
11/09/2026
Como Citar
BERNBECK, Simon; RAMALHO, Ricardo; AMENDOEIRA, Matheus; PEREIRA, Juliana Alves.
PrivDev: Mapping Static-Analysis Data Types to DPV. In: WORKSHOP DE VISUALIZAÇÃO, EVOLUÇÃO E MANUTENÇÃO DE SOFTWARE (VEM), 14. , 2026, São Paulo/SP.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2026
.
p. 116-122.
DOI: https://doi.org/10.5753/vem.2026.32973.
