{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,9]],"date-time":"2026-07-09T17:57:34Z","timestamp":1783619854303,"version":"3.55.0"},"publisher-location":"Cham","reference-count":36,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783030280048","type":"print"},{"value":"9783030280055","type":"electronic"}],"license":[{"start":{"date-parts":[[2019,1,1]],"date-time":"2019-01-01T00:00:00Z","timestamp":1546300800000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2019]]},"DOI":"10.1007\/978-3-030-28005-5_11","type":"book-chapter","created":{"date-parts":[[2019,9,8]],"date-time":"2019-09-08T19:03:18Z","timestamp":1567969398000},"page":"136-148","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":7,"title":["Designing a Data Protection Process Assessment Model Based on the GDPR"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-2352-1621","authenticated-orcid":false,"given":"St\u00e9phane","family":"Cortina","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4294-0848","authenticated-orcid":false,"given":"Philippe","family":"Valoggia","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"B\u00e9atrix","family":"Barafort","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8198-8708","authenticated-orcid":false,"given":"Alain","family":"Renault","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2019,8,22]]},"reference":[{"key":"11_CR1","unstructured":"Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (General Data Protection Regulation) (2016)"},{"key":"11_CR2","unstructured":"Guarda, P., Kiyavitskaya, N., Zannone, N.: Using semantic annotation for mining privacy and security requirements from European Union directives. Technical report # DISI-08-011 (2008)"},{"key":"11_CR3","unstructured":"ISO\/IEC: ISO\/IEC 33004 Information Technology\u2014Process assessment\u2014Requirements for process reference, process assessment and maturity models (2015)"},{"issue":"8","key":"11_CR4","doi-asserted-by":"publisher","first-page":"2471","DOI":"10.1093\/logcom\/exx009","volume":"27","author":"L Robaldo","year":"2017","unstructured":"Robaldo, L., Sun, X.: Reified input\/output logic: combining input\/output logic and reification to represent norms coming from existing legislation. J. Logic Comput. 27(8), 2471\u20132503 (2017)","journal-title":"J. Logic Comput."},{"key":"11_CR5","doi-asserted-by":"crossref","unstructured":"Paulk, M.C., Curtis, B., Chrissis, M.B., Weber, C.V.: The Capability Maturity Model for Software, Version 1.1 (No. CMU\/SEI-93-TR-24): Software Engineering Institute (1993)","DOI":"10.21236\/ADA263403"},{"key":"11_CR6","unstructured":"de Bruin, T., Rosemann, M., Freeze, R., Kulkarni, U.: Understanding the main phases of developing a maturity assessment model. In: 16th Australasian Conference on Information Systems (ACIS), Sydney (2005)"},{"issue":"3","key":"11_CR7","doi-asserted-by":"publisher","first-page":"213","DOI":"10.1007\/s12599-009-0044-5","volume":"1","author":"J Becker","year":"2009","unstructured":"Becker, J., Knackstedt, R., P\u00f6ppelbu\u00df, J.: Developing maturity models for IT management. Bus. Inf. Syst. Eng. 1(3), 213\u2013222 (2009)","journal-title":"Bus. Inf. Syst. Eng."},{"key":"11_CR8","unstructured":"P\u00f6ppelbu\u00df, J., R\u00f6glinger, M.: What makes a useful maturity model? A framework of general design principles for maturity models and its demonstration in business process management. In: ECIS 2011 (2011)"},{"key":"11_CR9","doi-asserted-by":"publisher","first-page":"122","DOI":"10.1016\/j.infsof.2016.01.010","volume":"75","author":"A Tarhan","year":"2016","unstructured":"Tarhan, A., Turetken, O., Reijers, H.A.: Business process maturity models: a systematic literature review. Inf. Softw. Technol. 75, 122\u2013134 (2016)","journal-title":"Inf. Softw. Technol."},{"key":"11_CR10","unstructured":"ISO\/IEC: ISO\/IEC 330xx Information Technology - Process Assessment (2013, 2017)"},{"key":"11_CR11","unstructured":"ISO\/IEC: ISO\/IEC 33002 Information Technology\u2014Process assessment\u2014Requirements for performing process assessment (2015)"},{"key":"11_CR12","unstructured":"ISO\/IEC 15504-5: Information Technology \u2013 Process assessment \u2013 Part 5: An exemplar software life cycle process assessment model. International Organization for Standardization, Geneva (2012)"},{"issue":"1","key":"11_CR13","doi-asserted-by":"publisher","first-page":"13","DOI":"10.1002\/spip.190","volume":"9","author":"A Cass","year":"2004","unstructured":"Cass, A., V\u00f6lcker, C., Ouared, R., Dorling, A., Winzer, L., Carranza, J.M.: SPICE for SPACE trials, risk analysis, and process improvement. Softw. Process: Improv. Pract. 9(1), 13\u201321 (2004)","journal-title":"Softw. Process: Improv. Pract."},{"key":"11_CR14","unstructured":"Automotive Spice \u00ae (2015). \n                    http:\/\/www.automotivespice.com\/fileadmin\/software-download\/Automotive_SPICE_PAM_30.pdf\n                    \n                  . Accessed 12 Apr 2019"},{"key":"11_CR15","unstructured":"Pries-Heje, J., Johansen, J.: SPI Manifesto. European System & Software Process Improvement and Innovation (2010)"},{"issue":"4","key":"11_CR16","doi-asserted-by":"publisher","first-page":"92","DOI":"10.1109\/MS.2010.96","volume":"27","author":"G Wangenheim von","year":"2010","unstructured":"von Wangenheim, G., Hauck, J.C.R., Zoucas, A., Salviano, C.F., McCaffery, F., Shull, F.: Creating software process capability\/maturity models. IEEE Softw. 27(4), 92\u201394 (2010)","journal-title":"IEEE Softw."},{"key":"11_CR17","series-title":"Communications in Computer and Information Science","doi-asserted-by":"publisher","first-page":"24","DOI":"10.1007\/978-3-319-13036-1_3","volume-title":"Software Process Improvement and Capability Determination","author":"F Stallinger","year":"2014","unstructured":"Stallinger, F., Pl\u00f6sch, R.: Towards methodological support for the engineering of process reference models for product software. In: Mitasiunas, A., Rout, T., O\u2019Connor, R.V., Dorling, A. (eds.) SPICE 2014. CCIS, vol. 477, pp. 24\u201335. Springer, Cham (2014). \n                    https:\/\/doi.org\/10.1007\/978-3-319-13036-1_3"},{"key":"11_CR18","unstructured":"Barafort, B., Renault, A., Picard, M., Cortina, S.: A transformation process for building PRMs and PAMs based on a collection of requirements \u2013 example with ISO\/IEC 20000. In: 8th International SPICE 2008 Conference, Nuremberg (2008)"},{"key":"11_CR19","doi-asserted-by":"crossref","unstructured":"Rifaut, A., Dubois, E.: Using goal-oriented requirements engineering for improving the quality of ISO\/IEC 15504 based compliance assessment frameworks. In: 16th IEEE International Requirements Engineering, RE 2008 (2008)","DOI":"10.1109\/RE.2008.44"},{"key":"11_CR20","unstructured":"Cortina, S., Picard, M., Vald\u00e9s, O., Renault, A.: A challenging process models development: the ITIL v3 lifecycle processes. In: The International Conference SPICE, pp. 59\u201366 (2010)"},{"key":"11_CR21","doi-asserted-by":"crossref","unstructured":"Barafort, B., Shrestha, A., Cortina, S., Renault, A.: A software artefact to support and automate process assessment: a case study of the evolution of the TIPA\u00ae framework. In: Computer Standards & Interfaces, vol. 60 (2018)","DOI":"10.1016\/j.csi.2018.04.009"},{"key":"11_CR22","series-title":"Communications in Computer and Information Science","doi-asserted-by":"publisher","first-page":"136","DOI":"10.1007\/978-3-319-97925-0_11","volume-title":"Systems, Software and Services Process Improvement","author":"S Renault","year":"2018","unstructured":"Renault, S., Cortina, S., Valoggia, P.: Designing a process assessment model based on multiple sources - a procurement case. In: Larrucea, X., Santamaria, I., O\u2019Connor, R.V., Messnarz, R. (eds.) EuroSPI 2018. CCIS, vol. 896, pp. 136\u2013146. Springer, Cham (2018). \n                    https:\/\/doi.org\/10.1007\/978-3-319-97925-0_11"},{"key":"11_CR23","first-page":"565","volume":"27","author":"M Lepmets","year":"2015","unstructured":"Lepmets, M., Clarke, P., McCaffery, F., Dorling, A., Finnegan, A.: Development of MDevSPICE\u00ae - the medical device software process assessment framework. J. Softw.: Evol. Process 27, 565\u2013572 (2015). (Special Issue - EuroSPI 2014)","journal-title":"J. Softw.: Evol. Process"},{"key":"11_CR24","doi-asserted-by":"crossref","unstructured":"Breaux, T.D., Vail, M.W., Ant\u00f3n, A.I.: Towards regulatory compliance: extracting rights and obligations to align requirements with regulations. In: Proceedings of RE 2006, Washington, DC, USA, pp. 46\u201355. IEEE Computer Society Press, Los Alamitos (2006)","DOI":"10.1109\/RE.2006.68"},{"key":"11_CR25","doi-asserted-by":"crossref","unstructured":"Bhatia, J., Breaux, T.D.: Semantic incompleteness in privacy policy goals. In: 2018 IEEE 26th International Requirements Engineering Conference (RE), pp. 159\u2013169. IEEE (2018)","DOI":"10.1109\/RE.2018.00025"},{"key":"11_CR26","unstructured":"The Cabinet Office. ITIL Lifecycle Publication Suite. TSO Edition (2011)"},{"key":"11_CR27","unstructured":"Article 29 Data Protection Working Party. Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is \u201clikely to result in a high risk\u201d for the purposes of Regulation 2016\/679. WP 248 rev.01 (2017)"},{"key":"11_CR28","unstructured":"Article 29 Data Protection Working Party. Guidelines on Personal data breach notification under Regulation 2016\/679. WP250 rev.01 (2017)"},{"key":"11_CR29","unstructured":"Article 29 Data Protection Working Party. Guidelines on the right to \u201cdata portability\u201d. WP242 rev.01 (2016)"},{"key":"11_CR30","unstructured":"Article 29 Data Protection Working Party. Guidelines on transparency under Regulation 2016\/679. WP260 rev.01 (2017)"},{"key":"11_CR31","unstructured":"Article 29 Data Protection Working Party. Guidelines on consent under Regulation 2016\/679. WP259 rev.01 (2017)"},{"key":"11_CR32","unstructured":"https:\/\/www.cnil.fr\/en\/media\n                    \n                  . Accessed 12 Apr 2019"},{"key":"11_CR33","unstructured":"https:\/\/cnpd.public.lu\/en\/professionnels\/obligations.html\n                    \n                  . Accessed 12 Apr 2019"},{"key":"11_CR34","unstructured":"ISO\/IEC TR 24774: Software and systems engineering \u2013 Life cycle management \u2013 Guidelines for process description. International Organization for Standardization, Geneva (2010)"},{"key":"11_CR35","unstructured":"ISO\/IEC: ISO\/IEC 33020 Information Technology\u2014Process assessment\u2014Process measurement framework for assessment of process capability (2015)"},{"key":"11_CR36","unstructured":"ISO\/IEC: ISO\/IEC 33001 Information Technology\u2014Process assessment\u2014Concepts and terminology (2015)"}],"container-title":["Communications in Computer and Information Science","Systems, Software and Services Process Improvement"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-28005-5_11","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,9,8]],"date-time":"2019-09-08T19:05:11Z","timestamp":1567969511000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-030-28005-5_11"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019]]},"ISBN":["9783030280048","9783030280055"],"references-count":36,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-28005-5_11","relation":{},"ISSN":["1865-0929","1865-0937"],"issn-type":[{"value":"1865-0929","type":"print"},{"value":"1865-0937","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019]]},"assertion":[{"value":"22 August 2019","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"EuroSPI","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"European Conference on Software Process Improvement","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Edinburgh","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"United Kingdom","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2019","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"18 September 2019","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"20 September 2019","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"eurospi2019","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/2019.eurospi.net\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Single-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"2019.eurospi.net","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"28","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"18","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"0","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"64% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"4","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"4","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"No","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Research track: 18 papers out of 28 submissions. Selected and invited workshop papers: 41","order":10,"name":"additional_info_on_review_process","label":"Additional Info on Review Process","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}}]}}