# The General Data Protection Regulation: Requirements, Architectures, and Constraints

arXiv: https://arxiv.org/abs/1907.07498 · HTML: https://mlsanity.com/paper/1907.07498/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Jul 2019.

## Built on by (most cited first, 5 of 5)

- [Personalized Federated Domain Adaptation for Item-to-Item Recommendation](https://mlsanity.com/paper/2306.03191/) (2023)
- [Improving Radiology Report Conciseness and Structure via Local Large Language Models](https://mlsanity.com/paper/2411.05042/) (2024)
- [Quantum-Inspired Audio Unlearning: Towards Privacy-Preserving Voice Biometrics](https://mlsanity.com/paper/2507.22208/) (2025)
- [GraphToxin: Reconstructing Full Unlearned Graphs from Graph Unlearning](https://mlsanity.com/paper/2511.10936/) (2025)
- [Taipan: A Query-free Transfer-based Multiple Sensitive Attribute Inference Attack Solely from Auxiliary Graphs](https://mlsanity.com/paper/2602.06700/) (2026)

## Abstract (arXiv)

The General Data Protection Regulation (GDPR) in the European Union is the most famous recently enacted privacy regulation. Despite of the regulation's legal, political, and technological ramifications, relatively little research has been carried out for better understanding the GDPR's practical implications for requirements engineering and software architectures. Building on a grounded theory approach with close ties to the Finnish software industry, this paper contributes to the sealing of this gap in previous research. Three questions are asked and answered in the context of software development organizations. First, the paper elaborates nine practical constraints under which many small and medium-sized enterprises (SMEs) often operate when implementing solutions that address the new regulatory demands. Second, the paper elicits nine regulatory requirements from the GDPR for software architectures. Third, the paper presents an implementation for a software architecture that complies both with the requirements elicited and the constraints elaborated.