{"id":"https://openalex.org/W4308322115","doi":"https://doi.org/10.1007/s10270-022-01061-6","title":"Modeling ecosystems of reference frameworks for assurance: a case on privacy impact assessment regulation and guidelines","display_name":"Modeling ecosystems of reference frameworks for assurance: a case on privacy impact assessment regulation and guidelines","publication_year":2022,"publication_date":"2022-11-07","ids":{"openalex":"https://openalex.org/W4308322115","doi":"https://doi.org/10.1007/s10270-022-01061-6"},"language":"en","primary_location":{"id":"doi:10.1007/s10270-022-01061-6","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10270-022-01061-6","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10270-022-01061-6.pdf","source":{"id":"https://openalex.org/S64245694","display_name":"Software & Systems Modeling","issn_l":"1619-1366","issn":["1619-1366","1619-1374"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Software and Systems Modeling","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s10270-022-01061-6.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5083994226","display_name":"Alejandra Ru\u00edz","orcid":"https://orcid.org/0000-0001-7464-6291"},"institutions":[{"id":"https://openalex.org/I4210113430","display_name":"Tecnalia","ror":"https://ror.org/02fv8hj62","country_code":"ES","type":"other","lineage":["https://openalex.org/I4210113430"]},{"id":"https://openalex.org/I4210124459","display_name":"Association of Electronic and Information Technologies","ror":"https://ror.org/02trgdk48","country_code":"ES","type":"other","lineage":["https://openalex.org/I4210124459"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Alejandra Ruiz","raw_affiliation_strings":["Tecnalia, Basque Research and Technology Alliance (BRTA), Derio, Spain"],"raw_orcid":"https://orcid.org/0000-0001-7464-6291","affiliations":[{"raw_affiliation_string":"Tecnalia, Basque Research and Technology Alliance (BRTA), Derio, Spain","institution_ids":["https://openalex.org/I4210113430","https://openalex.org/I4210124459"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5016817062","display_name":"Yod-Samuel Mart\u00edn","orcid":"https://orcid.org/0000-0002-0065-5117"},"institutions":[{"id":"https://openalex.org/I88060688","display_name":"Universidad Polit\u00e9cnica de Madrid","ror":"https://ror.org/03n6nwv02","country_code":"ES","type":"education","lineage":["https://openalex.org/I88060688"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Yod-Samuel Martin","raw_affiliation_strings":["Universidad Politecnica de Madrid (UPM), Madrid, Spain"],"raw_orcid":"https://orcid.org/0000-0002-0065-5117","affiliations":[{"raw_affiliation_string":"Universidad Politecnica de Madrid (UPM), Madrid, Spain","institution_ids":["https://openalex.org/I88060688"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5016903971","display_name":"Jabier Martinez","orcid":"https://orcid.org/0000-0001-8742-9640"},"institutions":[{"id":"https://openalex.org/I4210113430","display_name":"Tecnalia","ror":"https://ror.org/02fv8hj62","country_code":"ES","type":"other","lineage":["https://openalex.org/I4210113430"]},{"id":"https://openalex.org/I4210124459","display_name":"Association of Electronic and Information Technologies","ror":"https://ror.org/02trgdk48","country_code":"ES","type":"other","lineage":["https://openalex.org/I4210124459"]}],"countries":["ES"],"is_corresponding":true,"raw_author_name":"Jabier Martinez","raw_affiliation_strings":["Tecnalia, Basque Research and Technology Alliance (BRTA), Derio, Spain"],"raw_orcid":"https://orcid.org/0000-0001-8742-9640","affiliations":[{"raw_affiliation_string":"Tecnalia, Basque Research and Technology Alliance (BRTA), Derio, Spain","institution_ids":["https://openalex.org/I4210113430","https://openalex.org/I4210124459"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5091673925","display_name":"Jacobo Quintans","orcid":null},"institutions":[{"id":"https://openalex.org/I88060688","display_name":"Universidad Polit\u00e9cnica de Madrid","ror":"https://ror.org/03n6nwv02","country_code":"ES","type":"education","lineage":["https://openalex.org/I88060688"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Jacobo Quintans","raw_affiliation_strings":["Universidad Politecnica de Madrid (UPM), Madrid, Spain"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universidad Politecnica de Madrid (UPM), Madrid, Spain","institution_ids":["https://openalex.org/I88060688"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5041350879","display_name":"Guillaume Mockly","orcid":null},"institutions":[{"id":"https://openalex.org/I4210117785","display_name":"Trialog (France)","ror":"https://ror.org/027xpc035","country_code":"FR","type":"company","lineage":["https://openalex.org/I4210117785"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Guillaume Mockly","raw_affiliation_strings":["Trialog, Paris, France"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Trialog, Paris, France","institution_ids":["https://openalex.org/I4210117785"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5046900276","display_name":"Am\u00e9lie Gyrard","orcid":"https://orcid.org/0000-0003-3938-5617"},"institutions":[{"id":"https://openalex.org/I4210117785","display_name":"Trialog (France)","ror":"https://ror.org/027xpc035","country_code":"FR","type":"company","lineage":["https://openalex.org/I4210117785"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Amelie Gyrard","raw_affiliation_strings":["Trialog, Paris, France"],"raw_orcid":"https://orcid.org/0000-0003-3938-5617","affiliations":[{"raw_affiliation_string":"Trialog, Paris, France","institution_ids":["https://openalex.org/I4210117785"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5049473749","display_name":"Tommaso Crepax","orcid":"https://orcid.org/0000-0003-0379-7521"},"institutions":[{"id":"https://openalex.org/I162290304","display_name":"Scuola Superiore Sant'Anna","ror":"https://ror.org/025602r80","country_code":"IT","type":"education","lineage":["https://openalex.org/I162290304"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Tommaso Crepax","raw_affiliation_strings":["Scuola Universitaria Superiore Sant\u2019Anna, Pisa, Italy"],"raw_orcid":"https://orcid.org/0000-0003-0379-7521","affiliations":[{"raw_affiliation_string":"Scuola Universitaria Superiore Sant\u2019Anna, Pisa, Italy","institution_ids":["https://openalex.org/I162290304"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5016903971"],"corresponding_institution_ids":["https://openalex.org/I4210113430","https://openalex.org/I4210124459"],"apc_list":{"value":2890,"currency":"USD","value_usd":2890},"apc_paid":{"value":2890,"currency":"USD","value_usd":2890},"fwci":0.3667,"has_fulltext":true,"cited_by_count":2,"citation_normalized_percentile":{"value":0.70335643,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":97},"biblio":{"volume":"22","issue":"4","first_page":"1175","last_page":"1196"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.9872999787330627,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.9872999787330627,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9707000255584717,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13295","display_name":"Safety Systems Engineering in Autonomy","score":0.9685999751091003,"subfield":{"id":"https://openalex.org/subfields/2213","display_name":"Safety, Risk, Reliability and Quality"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7033431529998779},{"id":"https://openalex.org/keywords/general-data-protection-regulation","display_name":"General Data Protection Regulation","score":0.6476030349731445},{"id":"https://openalex.org/keywords/privacy-by-design","display_name":"Privacy by Design","score":0.48798054456710815},{"id":"https://openalex.org/keywords/pace","display_name":"Pace","score":0.45538097620010376},{"id":"https://openalex.org/keywords/information-privacy","display_name":"Information privacy","score":0.4343664050102234},{"id":"https://openalex.org/keywords/data-protection-act-1998","display_name":"Data Protection Act 1998","score":0.43371301889419556},{"id":"https://openalex.org/keywords/risk-analysis","display_name":"Risk analysis (engineering)","score":0.42144066095352173},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.37801411747932434},{"id":"https://openalex.org/keywords/process-management","display_name":"Process management","score":0.37142470479011536},{"id":"https://openalex.org/keywords/knowledge-management","display_name":"Knowledge management","score":0.3406901955604553},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.17785128951072693}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7033431529998779},{"id":"https://openalex.org/C3090818","wikidata":"https://www.wikidata.org/wiki/Q1172506","display_name":"General Data Protection Regulation","level":3,"score":0.6476030349731445},{"id":"https://openalex.org/C193934123","wikidata":"https://www.wikidata.org/wiki/Q7246028","display_name":"Privacy by Design","level":3,"score":0.48798054456710815},{"id":"https://openalex.org/C2777526511","wikidata":"https://www.wikidata.org/wiki/Q691543","display_name":"Pace","level":2,"score":0.45538097620010376},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.4343664050102234},{"id":"https://openalex.org/C69360830","wikidata":"https://www.wikidata.org/wiki/Q1172237","display_name":"Data Protection Act 1998","level":2,"score":0.43371301889419556},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.42144066095352173},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.37801411747932434},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.37142470479011536},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.3406901955604553},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.17785128951072693},{"id":"https://openalex.org/C205649164","wikidata":"https://www.wikidata.org/wiki/Q1071","display_name":"Geography","level":0,"score":0.0},{"id":"https://openalex.org/C13280743","wikidata":"https://www.wikidata.org/wiki/Q131089","display_name":"Geodesy","level":1,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1007/s10270-022-01061-6","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10270-022-01061-6","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10270-022-01061-6.pdf","source":{"id":"https://openalex.org/S64245694","display_name":"Software & Systems Modeling","issn_l":"1619-1366","issn":["1619-1366","1619-1374"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Software and Systems Modeling","raw_type":"journal-article"},{"id":"pmh:oai:zenodo.org:7520779","is_oa":true,"landing_page_url":"https://zenodo.org/record/7520779","pdf_url":"https://zenodo.org/record/7520779","source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Springer","raw_type":"info:eu-repo/semantics/article"},{"id":"pmh:oai:dsp.tecnalia.com:11556/5063","is_oa":true,"landing_page_url":"https://hdl.handle.net/11556/5063","pdf_url":null,"source":{"id":"https://openalex.org/S4306402037","display_name":"TECNALIA Publications (Fundaci\u00f3n TECNALIA Research & Innovation)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4210113430","host_organization_name":"Tecnalia","host_organization_lineage":["https://openalex.org/I4210113430"],"host_organization_lineage_names":[],"type":"repository"},"license":"public-domain","license_id":"https://openalex.org/licenses/public-domain","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"journal article"}],"best_oa_location":{"id":"doi:10.1007/s10270-022-01061-6","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10270-022-01061-6","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10270-022-01061-6.pdf","source":{"id":"https://openalex.org/S64245694","display_name":"Software & Systems Modeling","issn_l":"1619-1366","issn":["1619-1366","1619-1374"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Software and Systems Modeling","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G8771292566","display_name":"Methods and tools for GDPR compliance through Privacy and Data Protection Engineering","funder_award_id":"787034","funder_id":"https://openalex.org/F4320338350","funder_display_name":"H2020 Security"}],"funders":[{"id":"https://openalex.org/F4320338350","display_name":"H2020 Security","ror":null}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4308322115.pdf","grobid_xml":"https://content.openalex.org/works/W4308322115.grobid-xml"},"referenced_works_count":15,"referenced_works":["https://openalex.org/W1548561497","https://openalex.org/W2194364680","https://openalex.org/W2293248835","https://openalex.org/W2304212401","https://openalex.org/W2515829640","https://openalex.org/W2572300001","https://openalex.org/W2884046240","https://openalex.org/W2888524033","https://openalex.org/W2891192261","https://openalex.org/W2897067826","https://openalex.org/W2946108943","https://openalex.org/W2963094141","https://openalex.org/W2993919393","https://openalex.org/W3026027662","https://openalex.org/W3102309732"],"related_works":["https://openalex.org/W2917102635","https://openalex.org/W3023256691","https://openalex.org/W2603253017","https://openalex.org/W2789497412","https://openalex.org/W2901967497","https://openalex.org/W2910484607","https://openalex.org/W2794700933","https://openalex.org/W3171079982","https://openalex.org/W3156135475","https://openalex.org/W4287071984"],"abstract_inverted_index":{"Abstract":[0],"To":[1,178],"assure":[2],"certain":[3,62],"critical":[4],"quality":[5],"properties":[6],"(e.g.,":[7,31,65],"safety,":[8],"security,":[9],"or":[10,23,75,89],"privacy),":[11],"supervisory":[12],"authorities":[13],"and":[14,41,107,131,145,172,186,226,270,289,298],"industrial":[15,87],"associations":[16],"provide":[17,109,282],"reference":[18,52,104],"frameworks":[19,56,105],"such":[20],"as":[21,209,246],"standards":[22,77,83],"guidelines":[24],"that":[25,174],"in":[26,48,78,159,188,277],"some":[27],"cases":[28],"are":[29,162],"enforced":[30],"regulations).":[32],"Given":[33],"the":[34,49,71,94,100,117,143,168,180,215,219,230,248,268,271,274,296],"pace":[35],"at":[36],"which":[37],"both":[38,267],"technical":[39,264],"advancements":[40],"risks":[42],"appear,":[43],"there":[44],"is":[45,125],"an":[46],"increase":[47],"number":[50],"of":[51,96,102,119,147,183,202,218,273,300],"frameworks.":[53],"As":[54],"several":[55],"might":[57],"apply":[58],"for":[59,67,84,98,116,237,262],"same":[60],"systems,":[61],"overlaps":[63],"appear":[64],"regulations":[66],"different":[68,120],"countries":[69],"where":[70],"system":[72,90],"will":[73],"operate,":[74],"generic":[76],"conjunction":[79],"with":[80],"more":[81,132],"concrete":[82,244],"a":[85,110,210,233,243,278,283],"given":[86],"sector":[88,245],"type).":[91],"We":[92,213,281],"propose":[93],"use":[95],"modelling":[97,208,269],"alleviating":[99],"complexity":[101],"these":[103,199],"ecosystems,":[106],"we":[108,191,205,228],"tool-supported":[111],"method":[112],"to":[113,152,165,167,266,293],"create":[114],"them":[115],"benefit":[118],"stakeholders.":[121],"The":[122,139,257],"case":[123],"study":[124],"based":[126],"on":[127,134,207,221,295],"privacy":[128,135,156,238,290],"data":[129,222],"protection,":[130],"concretely":[133],"impact":[136,224,239],"assessment":[137],"processes.":[138],"European":[140],"GDPR":[141,220],"regulates":[142],"movement":[144],"processing":[146],"personal":[148],"data,":[149],"and,":[150,241],"contrary":[151],"available":[153],"software":[154],"engineering":[155,235,291],"guidelines,":[157],"articles":[158],"legal":[160,184,216,287],"texts":[161],"usually":[163],"difficult":[164],"translate":[166],"underlying":[169],"processes,":[170],"artefacts":[171],"roles":[173],"they":[175],"refer":[176],"to.":[177],"facilitate":[179],"mutual":[181],"comprehension":[182],"experts":[185,288],"engineers,":[187],"this":[189,301],"work":[190],"investigate":[192],"how":[193],"mappings":[194],"can":[195],"be":[196],"created":[197],"between":[198],"two":[200],"domains":[201],"expertise.":[203],"Notably,":[204],"rely":[206],"central":[211],"point.":[212],"modelled":[214],"requirements":[217],"protection":[223],"assessments,":[225],"then,":[227],"selected":[229],"ISO/IEC":[231],"29134,":[232],"mainstream":[234],"guideline":[236],"assessment,":[240],"taking":[242],"example,":[247],"EU":[249],"Smart":[250],"Grid":[251],"Data":[252],"Protection":[253],"Impact":[254],"Assessment":[255],"template.":[256],"OpenCert":[258],"tool":[259],"was":[260],"used":[261],"providing":[263],"support":[265],"creation":[272],"mapping":[275],"models":[276],"systematic":[279],"way.":[280],"qualitative":[284],"evaluation":[285],"from":[286],"practitioners":[292],"report":[294],"benefits":[297],"limitations":[299],"approach.":[302]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1}],"updated_date":"2026-08-04T08:18:43.703281","created_date":"2025-10-10T00:00:00"}