The Data Privacy Vocabulary (DPV) Specification provides the concept Technology to represent how technologies are applied within the context of personal data and its processing. The TECH extension provides further specific details regarding technologies, their management, and relevance to actual real-world tools and systems. The namespace for terms in tech is https://w3id.org/dpv/tech#. The suggested prefix for the namespace is tech. The TECH vocabulary and its documentation is available on GitHub.
Contributing: The DPVCG welcomes participation to improve the DPV and associated resources, including expansion or refinement of concepts, requesting information and applications, and addressing open issues. See contributing guide for further information.
GitHub Issues are preferred for
discussion of this specification.
1. DPV and Related Resources
Data Privacy Vocabulary (DPV) Specification: is the base/core specification for the 'Data Privacy Vocabulary', which is extended for Personal Data [PD], Locations [LOC], Risk Management [RISK], Technology [TECH], and [AI]. Specific [LEGAL] extensions are also provided which model jurisdiction specific regulations and concepts . To support understanding and applications of [DPV], various guides and resources [GUIDES] are provided, including a [PRIMER]. A Search Index of all concepts from DPV and extensions is available.
[DPV] and related resources are published on GitHub. For a general overview of the Data Protection Vocabularies and Controls Community Group [DPVCG], its history, deliverables, and activities - refer to DPVCG Website. For meetings, see the DPVCG calendar.
The peer-reviewed article “Creating A Vocabulary for Data Privacy” presents a historical overview of the DPVCG, and describes the methodology and structure of the DPV along with describing its creation. An open-access version can be accessed here, here, and here. The article Data Privacy Vocabulary (DPV) - Version 2, accepted for presentation at the 23rd International Semantic Web Conference (ISWC 2024), describes the changes made in DPV v2.
The 'core' concepts in the TECH extension consist of:
Actor to represent the 'actors' or entities in specific roles such as developing, providing, or using technologies
Capability to represent the capabilities or functions of technologies
ProvisionMethod to represent how the technolgy is provided - such as services or products
CommunicationMechanism to represent how the technology uses or implements communication mechanisms such as networking, GPS, or Bluetooth
Documentation to represent documentation associated with technologies such as instructions and user manuals
DeploymentLocation to represent the location(s) where the technology is or will be deployed and used
IntendedUse to represent the intended use of the technology such as what its developer or provider envisioned the technology will be used for, or how the organisation intends to use the technology
tech:Actor: Actors and Entities involved in provision, use, and management of Technology
go to full definition
tech:Capability: Expression of what the technology is capable of achieving or providing
go to full definition
tech:CommunicationMechanism: Communication mechanism used or provided by Technology
go to full definition
tech:DeploymentLocation: Location for where technology is deployed and used
go to full definition
tech:Documentation: Information describing use, functionality, design, or other technical aspects of the Technology
go to full definition
tech:Function: Expression of what goals or purposes the technology's capabilities are being used towards or developed for
go to full definition
tech:IntendedUse: Describes the 'intended' use of the technology
go to full definition
tech:ProvisionMethod: Method associated with provision or use of technology
go to full definition
3. Actors involved in Technologies
To specify the specific actors and their roles in the context of technologies, the concept Actor is provided along with the relation hasActor to associate it with the technology. Further specific actors and their associations are defined by extending these concepts, for example:
Provider and hasProvider specifies who provides the technology. This could be the same entity as developer, or a different one - such as when the technology is repackaged or modified before provision.
User and hasUser specifies who uses or is the user for the technology.
Note: Technology User does not refer to end-user
Subject and hasSubject is the subject of the technology i.e. whom the technology is used on or subjected to. This may be directly (e.g. person within a CCTV camera's vision) or indirectly (e.g. person whose details were used as training data). What is considered a subject may be contextually dependant on the nature and scope of the technology as well as its application. In the future, we may separate this concept for further distinction between direct and indirect subjects (or use alternate terms) - if such categorisation is deemed beneficial in the description of individuals subjected to technologies.
Note: Technology actors defined in regulations
tech:Customer: Actor that uses Technology directly or indirectly by providing it to Users
go to full definition
Note: Why 'Intended Use' is needed instead of reusing 'Purpose'
To indicate the uses for which a technology is developed, or what it is planned to be used for, the TECH extension provides the concept IntendedUse and which is associated with using the relation hasIntendedUse. The 'intended use' of technology represents uses which an actor envisions the technology to be used for. This could be the developer who envisions specific uses of the technology while developing it, or a user who plans to use the technology for specific activities when they acquire it. Such intended uses can be represented by using concepts within the DPV and its extensions - such as purposes, processing operations, technical and organisational measures, and so on. Where the intended use cannot be represented by a single concept, multiple concepts can be combined by using the relations in a manner similar to the use of dpv:Process.
Intended Use is an intent or ex-ante indication or plan for the use of technology. The actual use of the technology should be represented within the context of a process instance. Where there is a difference between the intended and actual use, whether such differences are classified as 'misuses' or 'violations' depends on the context. For example if the technology has the intended use to send emails for account communications, and the actual use involved using the technology for sending newsletters, then the difference between intended and actual use may be classified as 'misuse' or it may lead to realising that the earlier intended use did not sufficiently represent all required uses of the technology, and lead to updating the intended uses. Thus, in practice, a technology may have several intended uses that evolve over time.
5. Provision of Technology
The provision of technology can happen via the following methods:
System, Component, and Algorithmic - that indicate whether the technology is provided as a system (e.g. stand alone), is intended to be used as a component in another system, or is algorithmic (e.g. implementation of a particular method).
Service, Goods, Product, and Subscription - that provide an indication of whether the technology is service (e.g. implemented to function as a service), or is a product or a subscription (e.g. provided by a vendor). In this, Service is extended to represent various kinds of CloudService such as Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS)
FixedUse indicates whether the technology has limitations of use e.g. specific number of application or single application, or those related to scale or scope. For example, a single use identifier or a one time scan for vulnerabilities.
tech:Algorithmic: Technology provided as an algorithm or method
go to full definition
Documentation represents information provided with technologies which 'document' or provide explanations or instructions associated with technologies. Documentation is associated with technology by using hasDocumentation, and conversely technology is associated with documentation by using dct:subject. To represent information about who provided the documentation, when, etc. - we recommend using DCMI Metadata Terms (DCT).
tech:Guide: Documentation that provides guidance regarding the technology
go to full definition
tech:Manual: Documentation that provides instructions for using, maintaining, developing, or performing other activities regarding the technology
go to full definition
tech:Plan: Plan associated with using, maintaining, developing, or performing other activities associated with technology
go to full definition
tech:DevelopmentPlan: Plan associated with developing technology
go to full definition
tech:Specification: Documentation that specifies requirements that must be satisfied by the technology
go to full definition
8. Status
Status of technology, represented by the concept TechnologyStatus, indicates its state of development, deployment, use, and any other relevant stages within the lifecycle. The relation dpv:hasStatus is used to indicate the status of a technology.
Note: Adding additional technology statuses
tech:TechnologyStatus: Status associated with development, deployment, and use of technology
go to full definition
tech:MarketAvailabilityStatus: Status indicating whether Technology is available on the market
go to full definition
tech:MarketAvailable: Status indicating Technology is available on the market
go to full definition
tech:MarketUnavailable: Status indicating Technology is unavailable on the market
go to full definition
tech:ProvisionStatus: Status indicating whether Technology has been provided
go to full definition
tech:NotProvided: Status indicating Technology has not been provided
go to full definition
tech:TechnologyReadinessLevel: Indication of maturity of Technology (ISO 16290:2013)
go to full definition
9. Tools
Tools are technologies which are commonly used or required, and for which providing a concept within the [TECH] extension would be helpful for representing practical use-cases.
Expression of what goals or purposes the technology's capabilities are being used towards or developed for
Usage Note
Function is a broad concept that can include purposes such as identify verification, capability such as image recognition, or specific security measures such as encryption
Intended use can be used to describe how the developer or provider of technology intends it to be used e.g. use a database to store data, and to describe the plan or 'intent' to use the technology by a user or operator e.g. use a database to store and analyse data. Intended Use can involve any concept e.g. DPV's purpose, processing, tech/org measures, and can be low-level purely technical uses such as store data or high-level goals such as legal compliance. Intended Use only describes the intent or ex-ante intention, and may be different from how the technology is being actually used - which is indicated by using isImplementedUsingTechnology in a process or other relevant context.
Operator and User are similar concepts but may refer to different actors, for example in the scenario where the user determines what actions to perform on the technology and the operator executes these actions by operating the technology
Actor that provides services in the context of Technology
Usage Note
"Partner" is a vague term and should not be used - instead the more specific terms provided in this vocabulary should be used. Partner refers to entities that provide services for the technology (as opposed to for using the technology) - for example to further develop or refine it, or to test or audit it.
DPV uses the following terms from [RDF] and [RDFS] with their defined meanings:
rdf:type to denote a concept is an instance of another concept
rdfs:Class to denote a concept is a Class or a category
rdfs:subClassOf to specify the concept is a subclass (subtype, sub-category, subset) of another concept
rdf:Property to denote a concept is a property or a relation
The following external concepts are re-used within DPV:
11. Contributors
The following people have contributed to this vocabulary. The names are ordered alphabetically. The affiliations are informative do not represent formal endorsements. Affiliations may be outdated. The list is generated automatically from the contributors listed for defined concepts.
Delaram Golpayegani (ADAPT Centre, Trinity College Dublin)
Harshvardhan J. Pandit (ADAPT Centre, Dublin City University)
Tek Raj Chhetri ()
Funding Acknowledgements
Funding Sponsors
The DPVCG was established as part of the SPECIAL H2020 Project, which received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No. 731601 from 2017 to 2019.
Harshvardhan J. Pandit was funded to work on DPV from 2020 to 2022 by the Irish Research Council's Government of Ireland Postdoctoral Fellowship Grant#GOIPD/2020/790.
The ADAPT SFI Centre for Digital Media Technology is funded by Science Foundation Ireland through the SFI Research Centres Programme and is co-funded under the European Regional Development Fund (ERDF) through Grant#13/RC/2106 (2018 to 2020) and Grant#13/RC/2106_P2 (2021 onwards).
Funding Acknowledgements for Contributors
The contributions of Beatriz Esteves have received funding through the PROTECT ITN Project from the European Union’s Horizon 2020 research and innovation programme under the Marie Skłodowska-Curie grant agreement No 813497.
The contributions of Harshvardhan J. Pandit have been made with the financial support of Science Foundation Ireland under Grant Agreement No. 13/RC/2106_P2 at the ADAPT SFI Research Centre.
