Data Privacy Vocabularies and Controls Community Group (DPVCG) repository containing specifications for Data Privacy Vocabulary (DPV) and its extensions, primer, and guides, and group meeting minutes.
links: Community Group | GitHub wiki
Announcement: DPV v2.1-RC feedback/review period until FEB-16 The DPVCG welcomes feedback and review on the v2.1 Release Candidate containing DPV and related specifications until FEB-16, after which, these documents will be published unless unresolved major issues have been identified. Feedback/review can be e.g., suggestions for improvements, fixing grammar/typos, additional information and references, and technical changes to files. The DPVCG shall discuss all submitted feedback and will resolve in through the weekly meetings. To submit feedback, please use GitHub issue#235.
The mission of the W3C Data Privacy Vocabularies and Controls CG (DPVCG) is to develop a taxonomy of privacy and data protection related terms, which include in particular terms from the new European General Data Protection Regulation (GDPR), such as a taxonomy of personal data as well as a classification of purposes (i.e., purposes for data collection), and events of disclosures, consent, and processing such personal data.
License: All work produced by DPVCG and provided through this repo or elsewhere is provided by contributors under the W3C Document License unless otherwise noted. A copy of the license is provided in the LICENSE.md file.
Guidelines for suggesting new concepts, identifying bugs and issues, and sending patches or PRs
Newcomers to the DPV are recommended to start with the Primer to familiarise themselves with the concepts, semantics, and usefulness of the DPV. A Concise Primer is also available for a quick (2-pager) introduction to DPV.
The Data Privacy Vocabulary (DPV) provides an ontology (classes and properties) along with taxonomies that represent real-world uses of these concepts for representing information regarding how (personal) data and technologies (including AI). For example, it provides concepts and taxonomies to represent:
- purposes of processing data or using technologies
- personal data categories
- processing operations on data
- technical and organisational measures for safeguarding data and processes
- legal basis used to indicate why it is legally permitted
- rights involved and how to exercise them
- risks applicable and what would be its consequences and impacts
The versionless base IRI https://w3id.org/dpvalways points to the latest release. The versioned base IRI for v2.0 is https://w3id.org/dpv/2.0 and for v2.1 is https://w3id.org/dpv/2.1.
The namespace for DPV terms is http://w3id.org/dpv#
with suggested prefix dpv
, and serialisations are provided in RDF/XML, Turtle, JSON-LD, and N3 formats. The default serialisations are defined using RDFS/SKOS semantics, with an alternate serialisation defined using OWL2 semantics.
These extensions provide additional concepts that extend the concepts and scope of the main DPV specification:
- Personal Data (PD) provides a taxonomy of personal data categories;
- Location (LOC) provides a taxonomy of location concepts based on ISO 3166 (countries, regions);
- Technology (TECH) provides a taxonomy of technology concepts;
- AI provides a taxonomy of AI concepts extending the TECH extension;
- Justifications provides concepts for representing justifications i.e. why something must be done or could not be done;
- Risk provides concepts for risk assessment and management;
In v2.1, the Sector and Standard group of extensions was added to the DPV specifications. Sector provides sector-specific concepts which extend concepts in other DPV extensions. Currently, the following sectors are represented: -SECTOR-EDUCATION for Education Sector -SECTOR-FINANCE for Finance Sector -SECTOR-HEALTH for Health Sector -SECTOR-INFRA for (Critical) Infrastructure Sector -SECTOR-LAW for Law Enforcement & Justice Sector -SECTOR-PUBLICSERVICES for Public Services Sector
The Standards extensions are aimed to provide additional concepts for implementing specific standards using DPV. Currently it contains IEEE-P7012 based on IEEE P7012 Draft Standard for Machine Readable Personal Privacy Terms.
The LEGAL extensions provide concepts associated with specific jurisdictions and the laws, authorities, and treaties within them. The Legal page provides an overview of these. The jurisdictions are represented by using their ISO 3166-2 codes.
- European Union (EU) with the following laws provided as modular extensions within the EU namespace:
- LEGAL-AT for Austria
- LEGAL-BE for Belgium
- LEGAL-BG for Bulgaria
- LEGAL-CY for Cyprus
- LEGAL-CZ for Czech Republic
- LEGAL-DE for Germany
- LEGAL-DK for Denmark
- LEGAL-EE for Estonia
- LEGAL-ES for Spain
- LEGAL-FI for Finland
- LEGAL-FR for France
- LEGAL-GB for United Kingdom of Great Britain and Northern Ireland
- LEGAL-GR for Greece
- LEGAL-HR for Croatia
- LEGAL-HU for Hungary
- LEGAL-IE for Ireland
- LEGAL-IS for Iceland
- LEGAL-IN for India
- LEGAL-IT for Italy
- LEGAL-LI for Liechtenstein
- LEGAL-LT for Lithuania
- LEGAL-LU for Luxembourg
- LEGAL-LV for Latvia
- LEGAL-MT for Malta
- LEGAL-NL for Netherlands
- LEGAL-NO for Norway
- LEGAL-PL for Poland
- LEGAL-PT for Portugal
- LEGAL-RO for Romania
- LEGAL-SE for Sweden
- LEGAL-SI for Slovenia
- LEGAL-SK for Slovakia
- LEGAL-US for United States of America (USA)
The NACE Taxonomy serialised in RDFS provides a serialisation of the NACE v2 taxonomy in RDFS for use with DPV terms. Since then, NACE v2.1 has been published by the EU Commission. The DPVCG has decided to retire/not provide an alternative serialisation of NACE as it provided no significant benefit and the best practice for using NACE is to always utilise the official authoritative version.
- The Primer is an introductory document for newcomers to understand the DPV and its concepts. A 2 Page Short Primer provides a succint introduction to the DPV.
- The Use-Cases and Requirements document lists the use-cases and requirements that led to the development of DPV.
- The Examples page provides an index of examples describing the use of DPV concepts.
- The Guides page lists guides for use of DPV in specific domains and applications
In addition to the above, we welcome participation in the following guides being developed:
- Using DPV with RDFS and SKOS
- Using DPV with JSON and CSV for non-semantic web systems
- Using DPV with ODRL
- Implementing ISO/IEC 29184:2020 Privacy Notices and Consent
- Data Breach Management for GDPR
- Data Protection Impact Assessment (DPIA) for GDPR
- Records of Processing Activities (ROPA) for GDPR
- Rights Management and Exercise
- For use of DPV from v2 onwards, Cite as: Data Privacy Vocabulary (DPV) -- Version 2 by Harshvardhan J. Pandit, Beatriz Esteves, Georg P. Krog, Paul Ryan, Delaram Golpayegani, Julian Flake; 23rd International Semantic Web Conference (ISWC 2024) https://doi.org/10.1007/978-3-031-77847-6_10
- For use of DPV up to v1 and v1.1, Cite as: The peer-reviewed article “Creating A Vocabulary for Data Privacy” presents a historical overview of the DPVCG, and describes the methodology and structure of the DPV along with describing its creation. An open-access version can be accessed here, here, and here.
- In addition to the above, each specifications or document may have additional references for peer-reviewed articles associated with it - these are provided at the top of each document.
Releases are provided through the GitHub feature at https://github.com/w3c/dpv/releases and contain zipped collections of DPV specifications, modules, extensions, and accompanying documents.
The following are final reports i.e. formally published by the W3C. Note that works considered to be in a 'draft' state are not formally published in this manner.
- Primer w3c/cg-reports link to be added
- DPV w3c/cg-reports link to be added
- Personal Data (PD) extension w3c/cg-reports link to be added
- Technology (TECH) extension w3c/cg-reports link to be added
- Risk (RISK) extension w3c/cg-reports link to be added
- Locations (LOC) extension w3c/cg-reports link to be added
- AI Technology (AI) extension w3c/cg-reports link to be added
- Justifications extension w3c/cg-reports link to be added
- Legal extensions w3c/cg-reports link to be added
- Austria (AT) w3c/cg-reports link to be added
- Belgium (BE) w3c/cg-reports link to be added
- Bulgaria (BG) w3c/cg-reports link to be added
- Cyprus (CY) w3c/cg-reports link to be added
- Czech Republic (CZ) w3c/cg-reports link to be added
- Germany (DE) w3c/cg-reports link to be added
- Denmark (DK) w3c/cg-reports link to be added
- Estonia (EE) w3c/cg-reports link to be added
- Spain (ES) w3c/cg-reports link to be added
- European Union (EU) w3c/cg-reports link to be added
- Finland (FI) w3c/cg-reports link to be added
- France (FR) w3c/cg-reports link to be added
- United Kingdom of Great Britain and Northern Ireland (GB) w3c/cg-reports link to be added
- Greece (GR) w3c/cg-reports link to be added
- Croatia (HR) w3c/cg-reports link to be added
- Hungary (HU) w3c/cg-reports link to be added
- Ireland (IE) w3c/cg-reports link to be added
- Iceland (IS) w3c/cg-reports link to be added
- India (IN) w3c/cg-reports link to be added
- Italy (IT) w3c/cg-reports link to be added
- Liechtenstein (LI) w3c/cg-reports link to be added
- Lithuania (LT) w3c/cg-reports link to be added
- Luxembourg (LU) w3c/cg-reports link to be added
- Latvia (LV) w3c/cg-reports link to be added
- Malta (MT) w3c/cg-reports link to be added
- Netherlands (NL) w3c/cg-reports link to be added
- Norway (NO) w3c/cg-reports link to be added
- Poland (PL) w3c/cg-reports link to be added
- Portugal (PT) w3c/cg-reports link to be added
- Romania (RO) w3c/cg-reports link to be added
- Sweden (SE) w3c/cg-reports link to be added
- Slovenia (SI) w3c/cg-reports link to be added
- Slovakia (SK) w3c/cg-reports link to be added
- United States of America (US) w3c/cg-reports link to be added
- United Kingdom of Great Britain and Northern Ireland (GB) w3c/cg-reports link to be added
- Legal extensions modelling laws
- EU General Data Protection Regulation (GDPR) w3c/cg-reports link to be added
- EU Data Governance Act (DSA) w3c/cg-reports link to be added
- EU Artificial Intelligence Act (AI Act) w3c/cg-reports link to be added
- EU Network and Information Systems Directive (NIS2) w3c/cg-reports link to be added
- EU Charter of Fundamental Rights w3c/cg-reports link to be added
- Primer w3c/cg-reports link
- DPV w3c/cg-reports link
- Personal Data (PD) extension w3c/cg-reports link
- Technology (TECH) extension w3c/cg-reports link
- Risk (RISK) extension w3c/cg-reports link
- Locations (LOC) extension w3c/cg-reports link
- AI Technology (AI) extension w3c/cg-reports link
- Justifications extension w3c/cg-reports link
- Legal extensions w3c/cg-reports link
- Germany (DE) w3c/cg-reports link
- European Union (EU) w3c/cg-reports link
- United Kingdom of Great Britain and Northern Ireland (GB) w3c/cg-reports link
- Ireland (IE) w3c/cg-reports link
- India (IN) w3c/cg-reports link
- United Stated of America (US) w3c/cg-reports link
- Primer w3c/cg-reports link
- DPV w3c/cg-reports link
- DPV-GDPR w3c/cg-reports link
- DPV-PD w3c/cg-reports link
- DPV-OWL w3c/cg-reports link
- DPV-OWL-GDPR w3c/cg-reports link
- DPV-OWL-PD w3c/cg-reports link
- Guide on using DPV in OWL2 w3c/cg-reports link
- DPV-SKOS w3c/cg-reports link
- DPV-SKOS-GDPR w3c/cg-reports link
- DPV-SKOS-PD w3c/cg-reports link
If you're unsure about something, or would like clarifications, or suggestions - please communicate with us or open an issue. We would be happy to help. You can view the current open issues and the public mailing list.
Membership to the group is open to all interested individuals and organisations. To join the group, you need a valid W3C account – which is free to get and can be requested here. The group meets usually through online meeting calls - see meetings calendar and minutes.
The DPVCG was established as part of the SPECIAL H2020 Project, which received funding from the European Union's Horizon 2020 research and innovation programme under grant agreement No. 731601 from 2017 to 2019.
Harshvardhan J. Pandit was funded to work as the chair of DPVCG from 2020 to 2022 by the Irish Research Council's Government of Ireland Postdoctoral Fellowship Grant#GOIPD/2020/790, and through the ADAPT SFI Centre for Digital Media Technology is funded by Science Foundation Ireland through the SFI Research Centres Programme and is co-funded under the European Regional Development Fund (ERDF) through Grant#13/RC/2106 (2018 to 2020) and Grant#13/RC/2106_P2 (2021 onwards).
Further funding acknowledgements for individual members are provided within relevant specifications.