# NL2GDPR: Automatically Develop GDPR Compliant Android Application Features from Natural Language

arXiv: https://arxiv.org/abs/2208.13361 · HTML: https://mlsanity.com/paper/2208.13361/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 18 of its 84 references that are in the map.
- First posted on arXiv 29 Aug 2022.

## Builds on (most cited first, 18 of 18)

- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [SpanBERT: Improving Pre-training by Representing and Predicting Spans](https://mlsanity.com/paper/1907.10529/) (2019)
- [Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring](https://mlsanity.com/paper/1802.04633/) (2018)
- [End-to-end Neural Coreference Resolution](https://mlsanity.com/paper/1707.07045/) (2017)
- [pix2code: Generating Code from a Graphical User Interface Screenshot](https://mlsanity.com/paper/1705.07962/) (2017)
- [Neural Open Information Extraction](https://mlsanity.com/paper/1805.04270/) (2018)
- [Revealing the Myth of Higher-Order Inference in Coreference Resolution](https://mlsanity.com/paper/2009.12013/) (2020)
- [Span Model for Open Information Extraction on Accurate Corpus](https://mlsanity.com/paper/1901.10879/) (2019)
- [Learning Paraphrastic Sentence Embeddings from Back-Translated Bitext](https://mlsanity.com/paper/1706.01847/) (2017)
- [Multi2OIE: Multilingual Open Information Extraction Based on Multi-Head Attention with BERT](https://mlsanity.com/paper/2009.08128/) (2020)
- [(Un)informed Consent: Studying GDPR Consent Notices in the Field](https://mlsanity.com/paper/1909.02638/) (2019)
- [The Privacy Policy Landscape After the GDPR](https://mlsanity.com/paper/1809.08396/) (2018)
- [Logician: A Unified End-to-End Neural Approach for Open-Domain Information Extraction](https://mlsanity.com/paper/1904.12535/) (2019)
- [Deep Neural Network Based Relation Extraction: An Overview](https://mlsanity.com/paper/2101.01907/) (2021)
- [An Empirical Evaluation of GDPR Compliance Violations in Android mHealth Apps](https://mlsanity.com/paper/2008.05864/) (2020)
- [Integrity Authentication in Tree Models](https://mlsanity.com/paper/2205.15444/) (2022)
- [Text2App: A Framework for Creating Android Apps from Text Descriptions](https://mlsanity.com/paper/2104.08301/) (2021)
- [Designing Data Protection for GDPR Compliance into IoT Healthcare Systems](https://mlsanity.com/paper/1901.02426/) (2019)

## Abstract (arXiv)

The recent privacy leakage incidences and the more strict policy regulations demand a much higher standard of compliance for companies and mobile apps. However, such obligations also impose significant challenges on app developers for complying with these regulations that contain various perspectives, activities, and roles, especially for small companies and developers who are less experienced in this matter or with limited resources. To address these hurdles, we develop an automatic tool, NL2GDPR, which can generate policies from natural language descriptions from the developer while also ensuring the app's functionalities are compliant with General Data Protection Regulation (GDPR). NL2GDPR is developed by leveraging an information extraction tool, OIA (Open Information Annotation), developed by Baidu Cognitive Computing Lab. At the core, NL2GDPR is a privacy-centric information extraction model, appended with a GDPR policy finder and a policy generator. We perform a comprehensive study to grasp the challenges in extracting privacy-centric information and generating privacy policies, while exploiting optimizations for this specific task. With NL2GDPR, we can achieve 92.9%, 95.2%, and 98.4% accuracy in correctly identifying GDPR policies related to personal data storage, process, and share types, respectively. To the best of our knowledge, NL2GDPR is the first tool that allows a developer to automatically generate GDPR compliant policies, with only the need of entering the natural language for describing the app features. Note that other non-GDPR-related features might be integrated with the generated features to build a complex app.