ComplyQL: Towards Building GDPR Storage Compliant Applications

Cristi Savin

Key information

Authors:

Supervisors:

Nuno Miguel Carvalho dos Santos (Nuno Miguel Carvalho dos Santos); José Faustino Fragoso Femenin dos Santos (José Faustino Fragoso Femenin dos Santos)

Published in

November 6, 2024

Abstract

Modern web applications collect and store significant amounts of personal data, posing challenges for ensuring compliance with the General Data Protection Regulation (GDPR). Introduced by the European Union in 2018, the GDPR sets strict requirements for how personal data should be collected, stored, processed, and secured, with a strong emphasis on protecting user privacy. However, many existing applications fail to meet these standards due to a lack of tools capable of addressing GDPR’s comprehensive provisions. Consequently, both users and organizations face risks, including data leaks and significant legal penalties, respectively. This thesis introduces ComplyQL, a tool designed to facilitate GDPR compliance in MongoDB, Express.js, React.js, Node.js (MERN) stack applications by focusing on critical aspects of data storage, a step towards general GDPR compliance. Integrated in ComplyQL are the Graph Generation Engine (GGE), which builds a Code Property Graph (CPG) capable of capturing database configuration information, and the Query Execution Engine (QEE), which runs a set of compliance queries against the CPG to detect potential violations in data storage practices, making it a valuable asset for developers seeking to build GDPR-compliant applications. In addition to the tool’s design and implementation, this thesis contributes a curated test suite of MERN stack applications, each paired with a GDPR Specification Policy and their own DB configuration files. This same set is used for the evaluation of ComplyQL where insight both into its effectiveness at detecting GDPR storage violations and into its performance overhead is given.