  Processing personal data is regulated in Europe by the General Data
Protection Regulation (GDPR) through data processing agreements (DPAs).
Checking the compliance of DPAs contributes to the compliance verification of
software systems as DPAs are an important source of requirements for software
development involving the processing of personal data. However, manually
checking whether a given DPA complies with GDPR is challenging as it requires
significant time and effort for understanding and identifying DPA-relevant
compliance requirements in GDPR and then verifying these requirements in the
DPA. In this paper, we propose an automated solution to check the compliance of
a given DPA against GDPR. In close interaction with legal experts, we first
built two artifacts: (i) the "shall" requirements extracted from the GDPR
provisions relevant to DPA compliance and (ii) a glossary table defining the
legal concepts in the requirements. Then, we developed an automated solution
that leverages natural language processing (NLP) technologies to check the
compliance of a given DPA against these "shall" requirements. Specifically, our
approach automatically generates phrasal-level representations for the textual
content of the DPA and compares it against predefined representations of the
"shall" requirements. Over a dataset of 30 actual DPAs, the approach correctly
finds 618 out of 750 genuine violations while raising 76 false violations, and
further correctly identifies 524 satisfied requirements. The approach has thus
an average precision of 89.1%, a recall of 82.4%, and an accuracy of 84.6%.
Compared to a baseline that relies on off-the-shelf NLP tools, our approach
provides an average accuracy gain of ~20 percentage points. The accuracy of our
approach can be improved to ~94% with limited manual verification effort.

Software Engineering