{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,13]],"date-time":"2026-07-13T18:20:39Z","timestamp":1783966839590,"version":"3.55.0"},"reference-count":73,"publisher":"MDPI AG","issue":"10","license":[{"start":{"date-parts":[[2022,9,24]],"date-time":"2022-09-24T00:00:00Z","timestamp":1663977600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Horizon 2020","award":["871477"],"award-info":[{"award-number":["871477"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>In the past few years, the main research efforts regarding General Data Protection Regulation (GDPR)-compliant data sharing have been focused primarily on informed consent (one of the six GDPR lawful bases for data processing). In cases such as Business-to-Business (B2B) and Business-to-Consumer (B2C) data sharing, when consent might not be enough, many small and medium enterprises (SMEs) still depend on contracts\u2014a GDPR basis that is often overlooked due to its complexity. The contract\u2019s lifecycle comprises many stages (e.g., drafting, negotiation, and signing) that must be executed in compliance with GDPR. Despite the active research efforts on digital contracts, contract-based GDPR compliance and challenges such as contract interoperability have not been sufficiently elaborated on yet. Since knowledge graphs and ontologies provide interoperability and support knowledge discovery, we propose and develop a knowledge graph-based tool for GDPR contract compliance verification (CCV). It binds GDPR\u2019s legal basis to data sharing contracts. In addition, we conducted a performance evaluation in terms of execution time and test cases to validate CCV\u2019s correctness in determining the overhead and applicability of the proposed tool in smart city and insurance application scenarios. The evaluation results and the correctness of the CCV tool demonstrate the tool\u2019s practicability for deployment in the real world with minimum overhead.<\/jats:p>","DOI":"10.3390\/info13100447","type":"journal-article","created":{"date-parts":[[2022,9,25]],"date-time":"2022-09-25T23:13:27Z","timestamp":1664147607000},"page":"447","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":22,"title":["Automated GDPR Contract Compliance Verification Using Knowledge Graphs"],"prefix":"10.3390","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3345-387X","authenticated-orcid":false,"given":"Amar","family":"Tauqeer","sequence":"first","affiliation":[{"name":"Semantic Technology Institute (STI), Department of Computer Science, University of Innsbruck, 6020 Innsbruck, Austria"},{"name":"Consumption and Healthy Lifestyles Chair Group, Wageningen University & Research, 6706 KN Wageningen, The Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4512-5969","authenticated-orcid":false,"given":"Anelia","family":"Kurteva","sequence":"additional","affiliation":[{"name":"Semantic Technology Institute (STI), Department of Computer Science, University of Innsbruck, 6020 Innsbruck, Austria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3905-7878","authenticated-orcid":false,"given":"Tek Raj","family":"Chhetri","sequence":"additional","affiliation":[{"name":"Semantic Technology Institute (STI), Department of Computer Science, University of Innsbruck, 6020 Innsbruck, Austria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8766-4069","authenticated-orcid":false,"given":"Albin","family":"Ahmeti","sequence":"additional","affiliation":[{"name":"Semantic Technology Institute (STI), Department of Computer Science, University of Innsbruck, 6020 Innsbruck, Austria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1391-7104","authenticated-orcid":false,"given":"Anna","family":"Fensel","sequence":"additional","affiliation":[{"name":"Semantic Technology Institute (STI), Department of Computer Science, University of Innsbruck, 6020 Innsbruck, Austria"},{"name":"Consumption and Healthy Lifestyles Chair Group, Wageningen University & Research, 6706 KN Wageningen, The Netherlands"},{"name":"Wageningen Data Competence Center, Wageningen University & Research, 6708 PB Wageningen, The Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2022,9,24]]},"reference":[{"key":"ref_1","unstructured":"(2022, July 20). General Data Protection Regulation (GDPR). Available online: https:\/\/gdpr.eu\/what-is-gdpr\/."},{"key":"ref_2","unstructured":"Li, M., and Samavi, R. (2018). DSAP: Data Sharing Agreement Privacy Ontology. SWAT4LS, 2018. [Ph.D. Thesis, McMaster University]."},{"key":"#cr-split#-ref_3.1","doi-asserted-by":"crossref","unstructured":"European Parliament and Council (2016). Regulation","DOI":"10.59403\/1v8s9t8"},{"key":"#cr-split#-ref_3.2","unstructured":"(EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and REPEALING DIRective 95\/46\/EC (General Data Protection Regulation). Off. J. Eur. Union, L119, Available online: https:\/\/eur-lex.europa.eu\/eli\/reg\/2016\/679\/oj."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Habib, H., Li, M., Young, E., and Cranor, L. (May, January 29). \u201cOkay, whatever\u201d: An evaluation of cookie consent interfaces. Proceedings of the 2022 CHI Conference on Human Factors in Computing Systems, CHI \u201922, New Orleans, LA, USA.","DOI":"10.1145\/3491102.3501985"},{"key":"ref_5","unstructured":"(2022, July 26). European Data Protection Board. Available online: https:\/\/edpb.europa.eu\/edpb_en."},{"key":"ref_6","unstructured":"(2022, July 25). The Contractual Necessity Basis for Processing Personal Data in the Context of Online Services. Available online: https:\/\/edpb.europa.eu\/sites\/default\/files\/consultation\/edpb_draft_guidelines-art_6-1-b-final_public_consultation_version_en.pdf."},{"key":"ref_7","first-page":"1","article-title":"The Impact of GDPR on Global Technology Development","volume":"22","author":"Li","year":"2019","journal-title":"J. Glob. Inf. Technol. Manag."},{"key":"ref_8","unstructured":"Kurteva, A., Chhetri, T.R., Pandit, H.J., and Fensel, A. (2021). Consent through the lens of semantics: State of the art survey and best practices. Semant. Web, 1\u201327."},{"key":"ref_9","unstructured":"(2022, July 10). Breach of Contract. Available online: http:\/\/jec.unm.edu\/education\/online-training\/contract-law-tutorial\/breach-of-contract."},{"key":"ref_10","unstructured":"(2022, July 20). The smashHit EU H2020 Project. Available online: https:\/\/smashhit.eu\/."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"103981","DOI":"10.1016\/j.autcon.2021.103981","article-title":"Digital building twins and blockchain for performance-based (smart) contracts","volume":"133","author":"Hunhevicz","year":"2022","journal-title":"Autom. Constr."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"158","DOI":"10.1016\/j.future.2021.08.023","article-title":"Blockchain-enabled fraud discovery through abnormal smart contract detection on Ethereum","volume":"128","author":"Liu","year":"2022","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_13","unstructured":"(2022, July 20). Semantic Agreement. Available online: https:\/\/joinup.ec.europa.eu\/taxonomy\/term\/http_e_f_fdata_ceuropa_ceu_fdr8_fSemanticAgreement."},{"key":"ref_14","unstructured":"Pandit, H.J., O\u2019Sullivan, D., and Lewis, D. (2018, January 8\u201312). Towards knowledge-based systems for GDPR compliance. Proceedings of the International Semantic Web Conference (ISWC), Monterey, CA, USA."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Fensel, D., \u015eim\u015fek, U., Angele, K., Huaman, E., K\u00e4rle, E., Panasiuk, O., Toma, I., Umbrich, J., and Wahler, A. (2020). Knowledge Graphs, Springer.","DOI":"10.1007\/978-3-030-37439-6"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1007\/978-3-031-01918-0","article-title":"Knowledge Graphs","volume":"12","author":"Hogan","year":"2021","journal-title":"Synth. Lect. Data, Semant. Knowl."},{"key":"ref_17","unstructured":"Corrales, M., Fenwick, M., and Wrbka, S. (2021). Data protection issues for smart contracts. Smart Contracts: Technological, Business and Legal Perspectives, Bloomsbury. Available online: https:\/\/www.bloomsburycollections.com\/book\/smart-contracts-technological-business-and-legal-perspectives\/."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Jusic, A. (2020). Dealing with tensions between the blockchain and the GDPR. The LegalTech Book: The Legal Technology Handbook for Investors, Entrepreneurs and FinTech Visionaries, FINTECH Circle Ltd.","DOI":"10.1002\/9781119708063.ch22"},{"key":"ref_19","unstructured":"(2022, July 20). Smart Contract. Available online: https:\/\/corporatefinanceinstitute.com\/resources\/knowledge\/deals\/smart-contracts\/."},{"key":"ref_20","first-page":"47","article-title":"Privacy between Regulation and Technology: GDPR and the Blockchain","volume":"1","author":"Jusic","year":"2022","journal-title":"Int. Univ. Sarajevo (IUS) Law J."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Chhetri, T.R., Kurteva, A., Adigun, J.G., and Fensel, A. (2022). Knowledge Graph Based Hard Drive Failure Prediction. Sensors, 22.","DOI":"10.3390\/s22030985"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"715","DOI":"10.1016\/j.future.2021.06.001","article-title":"Representing emotions with knowledge graphs for movie recommendations","volume":"125","author":"Breitfuss","year":"2021","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Sermet, Y., and Demir, I. (2021). A Semantic Web Framework for Automated Smart Assistants: A Case Study for Public Health. Big Data Cogn. Comput., 5.","DOI":"10.3390\/bdcc5040057"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Chhetri, T.R., Kurteva, A., DeLong, R.J., Hilscher, R., Korte, K., and Fensel, A. (2022). Data Protection by Design Tool for Automated GDPR Compliance Verification Based on Semantically Modeled Informed Consent. Sensors, 22.","DOI":"10.3390\/s22072763"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Longo, A., Zappatore, M., and Bochicchio, M.A. (July, January 27). Service level aware\u2014Contract management. Proceedings of the 2015 IEEE International Conference on Services Computing, New York, NY, USA.","DOI":"10.1109\/SCC.2015.74"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"57","DOI":"10.1023\/A:1022445108617","article-title":"The WSLA Framework: Specifying and Monitoring Service Level Agreements for Web Services","volume":"11","author":"Keller","year":"2003","journal-title":"J. Netw. Syst. Manag."},{"key":"ref_27","unstructured":"(2022, July 20). NoSQL. Available online: https:\/\/www.ontotext.com\/knowledgehub\/fundamentals\/nosql-graph-database\/."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"9473","DOI":"10.1109\/ACCESS.2021.3049562","article-title":"A Blockchain-Driven Electronic Contract Management System for Commodity Procurement in Electronic Power Industry","volume":"9","author":"Guo","year":"2021","journal-title":"IEEE Access"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"09018","DOI":"10.1051\/e3sconf\/202016409018","article-title":"Development of contract management system for network companies under economy digitalization","volume":"164","author":"Voronova","year":"2020","journal-title":"E3S Web Conf. EDP Sci."},{"key":"ref_30","first-page":"67","article-title":"Journey into Dnv Hospital Accreditation and the Implementation of an Electronic Contract Management System (Ecms)","volume":"9","author":"Schmidt","year":"2019","journal-title":"J. Bus. Educ. Leadersh."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Simi\u0107, S., Markovi\u0107, M., and Gostoji\u0107, S. (2021, January 26\u201327). Smart contract and blockchain based contract management system. Proceedings of the 7th Conference on the Engineering of Computer Based Systems, ECBS 2021, Novi Sad, Serbia.","DOI":"10.1145\/3459960.3459975"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Zou, J., Wang, Y., and Lin, K.J. (2010, January 5\u201310). A formal service contract model for accountable SaaS and Cloud Services. Proceedings of the 2010 IEEE International Conference on Services Computing, Miami, FL, USA.","DOI":"10.1109\/SCC.2010.85"},{"key":"ref_33","unstructured":"Perrin, O., and Godart, C. (2004, January 6). An approach to implement contracts as trusted intermediaries. Proceedings of the First IEEE International Workshop on Electronic Contracting, San Diego, CA, USA."},{"key":"ref_34","unstructured":"Kabilan, V., and Johannesson, P. (2003, January 7\u20138). Semantic representation of contract knowledge using multi tier ontology. Proceedings of the First International Conference on Semantic Web and Databases, SWDB\u201903, Berlin, Germany."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"De Cesare, S., and Geerts, G.L. (2012, January 25\u201326). Toward a perdurantist ontology of contracts. Proceedings of the International Conference on Advanced Information Systems Engineering, Gda\u0144sk, Poland.","DOI":"10.1007\/978-3-642-31069-0_7"},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"12116","DOI":"10.1088\/1742-6596\/803\/1\/012116","article-title":"Application of the Financial Industry Business Ontology (FIBO) for development of a financial organization ontology","volume":"803","author":"Petrova","year":"2017","journal-title":"J. Phys. Conf. Ser."},{"key":"ref_37","unstructured":"Matthias, G. (2022, July 20). The Impact of the Gdpr on Third-Party Contracts in the Cloud Service Industry (Tilburg University, 2019). Available online: http:\/\/arno.uvt.nl\/show.cgi?fid=149355."},{"key":"ref_38","first-page":"76","article-title":"Practical Privacy: Report from the GDPR World","volume":"18","author":"Doe","year":"2018","journal-title":"Leg. Inf. Manag."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Ferrari, V. (2018). EU Blockchain Observatory and Forum Workshop on GDPR, Data Policy and Compliance. Soc. Sci. Res. Netw. (SSRN) Electron. J., 8.","DOI":"10.2139\/ssrn.3247494"},{"key":"ref_40","unstructured":"Godart, C., Gronau, N., Sharma, S., and Canals, G. (2009, January 23\u201325). Implementing a rule-based contract compliance checker. Proceedings of the 9th IFIP WG 6.1 Conference on e-Business, e-Services and e-Society, I3E 2009, Nancy, France."},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Mamadolimova, A., Ambiah, N., and Lukose, D. (2011, January 12\u201314). Modeling Islamic finance knowledge for contract compliance in Islamic banking. Proceedings of the International Conference on Knowledge-Based and Intelligent Information and Engineering Systems, Kaiserslautern, Germany.","DOI":"10.1007\/978-3-642-23854-3_37"},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"881","DOI":"10.1016\/j.clsr.2018.06.009","article-title":"Supply chain arrangements: The ABC to GDPR compliance\u2014A spotlight on emerging market practice in supplier contracts in light of the GDPR","volume":"34","author":"Pantlin","year":"2018","journal-title":"Comput. Law Secur. Rev."},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"1498","DOI":"10.1109\/TSC.2020.2999559","article-title":"Tracking GDPR Compliance in Cloud-Based Service Delivery","volume":"15","author":"Barati","year":"2022","journal-title":"IEEE Trans. Serv. Comput."},{"key":"ref_44","unstructured":"Cambronero, M.E., Llana, L., and Pace, G.J. (2017, January 13\u201315). Timed contract compliance under event timing uncertainty. Proceedings of the Legal Knowledge and Information Systems: JURIX 2017: The Thirtieth Annual Conference JURIX, Luxembourg."},{"key":"ref_45","unstructured":"(2022, March 05). The smashHitCore Ontology. Available online: https:\/\/gitlab.atb-bremen.de\/smashhit\/semantic-model\/-\/blob\/master\/smashHitCore.owl."},{"key":"ref_46","unstructured":"Irwin, K., Yu, T., and Winsborough, W.H. (November, January 30). On the modeling and analysis of obligations. Proceedings of the 13th ACM Conference on Computer and Communications Security, Alexandria, VA, USA."},{"key":"ref_47","unstructured":"(2022, June 01). Resource Description Framework (RDF) Sparql Query. Available online: https:\/\/www.w3.org\/TR\/rdf-sparql-query\/."},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Dragoni, N., Giallorenzo, S., Lafuente, A.L., Mazzara, M., Montesi, F., Mustafin, R., and Safina, L. (2017). Microservices: Yesterday, today, and tomorrow. Present and Ulterior Software Engineering, Springer.","DOI":"10.1007\/978-3-319-67425-4_12"},{"key":"ref_49","unstructured":"(2022, June 01). Ontotext GraphDB. Available online: https:\/\/www.ontotext.com\/products\/graphdb\/."},{"key":"ref_50","unstructured":"(2022, June 01). Flask-apscheduler. Available online: https:\/\/viniciuschiele.github.io\/flask-apscheduler\/."},{"key":"ref_51","unstructured":"(2022, June 01). Contract Compliance Verification GitHub Repository. Available online: https:\/\/github.com\/AmarTauqeer\/Contract\/tree\/master\/backend\/."},{"key":"ref_52","unstructured":"(2022, June 01). Swagger API Documentation. Available online: https:\/\/swagger.io\/solutions\/api-documentation\/."},{"key":"ref_53","unstructured":"\u00cdzdemir, F., and \u00cddemi\u015f \u00cdzger, Z. (2021). Rivest-Shamir-Adleman algorithm. Partially Homomorphic Encryption, Springer."},{"key":"ref_54","first-page":"1","article-title":"Advanced encryption standard","volume":"6","author":"Selent","year":"2010","journal-title":"Rivier Acad. J."},{"key":"ref_55","first-page":"28","article-title":"PEP 8\u2013style guide for python code","volume":"1565","author":"Warsaw","year":"2001","journal-title":"Python. org"},{"key":"ref_56","unstructured":"(2022, June 20). JSON Web Tokens (JWT). Available online: https:\/\/www.json.org\/json-en.html."},{"key":"ref_57","unstructured":"(2022, July 20). Conference of the Independent Data Protection Supervisory Authorities of the Federation and the L\u00e4nder. The Standard Data Protection Model\u2014A Method for Data Protection Advising and Controlling on the Basis of Uniform Protection Goals, Version 2.0b. Available online: https:\/\/www.datenschutzzentrum.de\/uploads\/sdm\/SDM-Methodology_V2.0b.pdf."},{"key":"ref_58","unstructured":"(2022, June 08). Python. Available online: https:\/\/www.python.org\/."},{"key":"ref_59","unstructured":"(2022, June 08). Flask. Available online: https:\/\/flask.palletsprojects.com\/en\/2.0.x\/."},{"key":"ref_60","unstructured":"(2022, June 08). Flask-RESTful. Available online: https:\/\/flask-restful.readthedocs.io\/en\/latest\/."},{"key":"ref_61","unstructured":"(2022, June 08). Flask-SQLAlchemy. Available online: https:\/\/flask-sqlalchemy.palletsprojects.com\/en\/2.x\/."},{"key":"ref_62","unstructured":"(2022, June 08). Flask-Apispec: Auto-Documenting REST APIs for Flask. Available online: https:\/\/flask-apispec.readthedocs.io\/en\/latest\/."},{"key":"ref_63","unstructured":"(2022, June 08). PyCryptodome. Available online: https:\/\/www.pycryptodome.org\/en\/latest\/src\/introduction.html."},{"key":"ref_64","unstructured":"(2022, June 08). SPARQL Endpoint Interface to Python. Available online: https:\/\/sparqlwrapper.readthedocs.io\/en\/latest\/."},{"key":"ref_65","unstructured":"(2022, June 08). Docker. Available online: https:\/\/www.docker.com\/."},{"key":"ref_66","unstructured":"(2022, June 08). PyJWT. Available online: https:\/\/pyjwt.readthedocs.io\/en\/stable\/."},{"key":"ref_67","unstructured":"(2022, April 04). Marshmallow: Simplified Object Serialisation. Available online: https:\/\/marshmallow.readthedocs.io\/en\/stable\/index.html."},{"key":"ref_68","unstructured":"(2022, July 20). Federal Information Processing Standards Publication (FIPS), P. 197. Advanced Encryption Standard (AES), National Institute of Standards and Technology, US Department of Commerce, Available online: https:\/\/nvlpubs.nist.gov\/nistpubs\/fips\/nist.fips.197.pdf."},{"key":"ref_69","first-page":"1190","article-title":"Comparison of asymmetric algorithms in cryptography","volume":"3","author":"Garg","year":"2014","journal-title":"J. Comput. Sci. Mob. Comput. (IJCSMC)"},{"key":"ref_70","unstructured":"(2022, June 16). Unit Testing Framework. Available online: https:\/\/docs.python.org\/3\/library\/unittest.html."},{"key":"ref_71","unstructured":"Hoppe, T., Humm, B., and Reibold, A. (2018). Automated rights clearance using semantic web technologies: The DALICC framework. Semantic Applications: Methodology, Technology, Corporate Use, Springer."},{"key":"ref_72","unstructured":"(2022, June 16). Licence Clearance Tool Description and Documentation. Available online: https:\/\/wiki.ni4os.eu\/index.php\/LicenseClearanceTool-DescriptionandDocumentation."}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/13\/10\/447\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T00:38:50Z","timestamp":1760143130000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/13\/10\/447"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,9,24]]},"references-count":73,"journal-issue":{"issue":"10","published-online":{"date-parts":[[2022,10]]}},"alternative-id":["info13100447"],"URL":"https:\/\/doi.org\/10.3390\/info13100447","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,9,24]]}}}