This document provides additional details and examples for rules concepts for permission, prohibition, and obligation used in the Data Privacy Vocabulary [[DPV]], and is a companion to the [[DPV]] specification.
Contributing: The DPVCG welcomes participation to improve the DPV and associated resources, including expansion or refinement of concepts, requesting information and applications, and addressing open issues. See contributing guide for further information.
[[[DPV]]]: is the base/core specification for the 'Data Privacy Vocabulary', which is extended for Personal Data [[PD]], Locations [[LOC]], Risk Management [[RISK]], Technology [[TECH]], and [[AI]]. Specific [[LEGAL]] extensions are also provided which model jurisdiction specific regulations and concepts - see the complete list of extensions. To support understanding and applications of [[DPV]], various guides and resources [[GUIDES]] are provided, including a [[PRIMER]]. A Search Index of all concepts from DPV and extensions is available.
[[DPV]] and related resources are published on GitHub. For a general overview of the Data Protection Vocabularies and Controls Community Group [[DPVCG]], its history, deliverables, and activities - refer to DPVCG Website. For meetings, see the DPVCG calendar.
The peer-reviewed article “Creating A Vocabulary for Data Privacy” presents a historical overview of the DPVCG, and describes the methodology and structure of the DPV along with describing its creation. An open-access version can be accessed here, here, and here. The article Data Privacy Vocabulary (DPV) - Version 2, accepted for presentation at the 23rd International Semantic Web Conference (ISWC 2024), describes the changes made in DPV v2.
DPV provides the concept [=Rule=] to specify requirements, constraints, and other forms of 'rules' that are associated with specific contexts (e.g., processing activities) using the relation [=hasRule=]. DPV provides three forms of Rules to represent [=Permission=], [=Prohibition=] and [=Obligation=], and their corresponding relations [=hasPermission=], [=hasProhibition=] and [=hasObligation=], to indicate a Rule that specifies whether something is permitted, prohibited or an obligation, respectively.
[=Permission=] refers to the indicated context being allowed or approved to be carried out. Permissions are only a 'permissive signal' i.e. it is not necessary to carry out an activity just because it is permitted (see obligation for this). Permissions can be used to record what has been permitted or to distinguish the 'permissive' parts from other 'non-permissive' or prohibitive parts, such as in use-cases for policies, agreements, consent records, and risk assessments.
[=Prohibition=] represents the indicated context is not allowed or it is not approved to be carried out. If something is expressed as a prohibition - it explicitly indicates that it must not occur. Unlike permission, prohibition is a 'strong' rule i.e. if something is prohibited, then it is necessary that it not be carried out.
[=Obligation=] is the antipodal rule for prohibitions, which means if something is an obligation then it is necessary for it to be carried. It differs from permissions - which are a 'soft' rule i.e. a permitted activity is not necessary to be carried out.
DPV does not define additional semantics for rules and limits its scope and focus to provide a simple way to specify permissions, prohibitions, and obligations as common rules associated with activities. For a more extensive and richer set of semantics and concepts to represent rules, DPVCG suggests looking towards other languages, such as [[ODRL]], [[SHACL]], and [[RuleML]] that have been developed with the specific goal of representing and applying rules. We welcome contributions for aligning DPV with these, and for providing guidance on how to complement DPV's rule-based concepts with external languages.
Though DPV provides concepts representing deontic logic, it does not specify what should be the 'default' interpretation in relation to rules, i.e. it does not provide an interpretation of whether some rules apply automatically unless otherwise declared. For example, in declaring an instance of Process, the assumption is that the activities are modelled for what is happening or what is intended/planned to happen. The explicit annotation using a Permission rule adds information about whether some activity is permitted (and its associated information). Instead, if the use-case is using DPV to only document activities that are permitted, there is no need to explicitly specify the permissions. Similarly, just because something is happening or planned to happen, it cannot be assumed to be permitted (e.g. pending evaluation of legal requirements).
This lack of default interpretation enables modularity in the use of DPV concepts. For example, an instance of `dpv:Process` which does not have a `dpv:hasRule` declared within it, can be made part of a rule to specify permissions, prohibitions, or obligations regarding the process. If instead the process had a default interpretation (e.g. permission), then it would require creating a separate instance with the same information - leading to duplicated efforts. While an apparent solution is to create a mechanism whereby the rule in the process is overridden with the intended 'outer' rule or context e.g. to specify the prohibition in one process overrules permission in another process, this prevents the combination of rules to describe situations such as a permission for a larger context within which specific parts are prohibited or obligated.
In representing Rules, DPV only provides the concept and does not express any inherent semantics on what those rules mean in relation to each other. For example, DPV does not express Permission to be non-compatible or disjoint from Prohibition. This is to separate the interpretation and application of rules based on the necessities of a use-case. For example, in a legal investigation it may be prudent to specify permission and prohibition can never occur together, but this may not be true if there are different legal requirements that allow a prohibition to be resolved or deferred, such as through another permission that overrides the prohibition.
Further, as described earlier in the section on default interpretations, it is possible to mix or nest rules such as through processes. For example, if `ProcessA` is a permitted process and contains `ProcessB` which is a prohibited process, DPV does not dictate what should be default interpretation for this arrangement. The role of DPV concepts regarding rules, as of now, is to provide a simplified indication of whether something is permitted, prohibited, or obligated. Further interpretations require creation of a formal specification that dictates how rules should function together. For example, depending on the use-case, several interpretations are possible for the example described here:
The above example interpretations only concerned permissions and prohibitions, and did not include obligations - or other concepts such as duties, dispensations, exceptions, and defeasibility. From this, it should be clear how the specification and interpretation of rules can be quite complex and has a large impact on the intended activities and information being documented.
DPV does not define how rules are 'triggered' i.e. how to specify under what conditions a rule should become applicable or is exempted from being applied. Some common triggers for rules to be applied are provided here as examples:
[[ODRL]] provides a W3C standardised representation for expressing policies containing rules such as for permissions, prohibitions, obligations over 'assets' and the involved 'parties'. While ODRL focuses on providing a general structure for policies without jurisdictional concepts or modelling, it complements DPV by enabling declaration of policies, agreements, and other similar documents in a structured, interoperable, and standardised manner. The DPV concepts enable specifying the exact information within the structure provided by ODRL - which can be useful for two entities to exchange information. For example, in a controller-processor agreement, ODRL can be used to define the agreement in terms of involved parties, their roles, and which entity is responsible for performing which actions, as well as the expected ex-post consequences of those actions - such as for reporting from processor to controller, or to indicate what should be done should a particular requirement is violated.
Term | Obligation | Prefix | dpv |
---|---|---|---|
Label | Obligation | ||
IRI | https://w3id.org/dpv#Obligation | ||
Type | rdfs:Class, skos:Concept, dpv:Rule | ||
Broader/Parent types | dpv:Rule | ||
Object of relation | dpv:hasFulfillmentsStatus, dpv:hasObligation, dpv:hasRule | ||
Definition | A rule describing an obligation for performing an activity | ||
Date Created | 2022-10-19 | ||
Contributors | Harshvardhan J. Pandit, Georg P. Krog, Beatriz Esteves, Paul Ryan | ||
See More: | section RULES in DPV |
Term | ObligationFulfilled | Prefix | dpv |
---|---|---|---|
Label | Obligation Fulfilled | ||
IRI | https://w3id.org/dpv#ObligationFulfilled | ||
Type | rdfs:Class, skos:Concept, dpv:RuleFulfilmentStatus | ||
Broader/Parent types | dpv:RuleFulfilmentStatus → dpv:Status → dpv:Context | ||
Object of relation | dpv:hasContext, dpv:hasStatus | ||
Definition | Status indicating an obligation has been fulfilled i.e. the activity stated as being required to be carried out has been successfully completed | ||
Date Created | 2024-09-10 | ||
Contributors | Harshvardhan J. Pandit | ||
See More: | section RULES in DPV |
Term | ObligationUnfulfilled | Prefix | dpv |
---|---|---|---|
Label | Obligation Unfulfilled | ||
IRI | https://w3id.org/dpv#ObligationUnfulfilled | ||
Type | rdfs:Class, skos:Concept, dpv:RuleFulfilmentStatus | ||
Broader/Parent types | dpv:RuleFulfilmentStatus → dpv:Status → dpv:Context | ||
Object of relation | dpv:hasContext, dpv:hasStatus | ||
Definition | Status indicating an obligation has not been fulfilled i.e. the activity stated as being required to be carried out has not been carried out but this is not considered as a violation e.g. there is still time to conduct the activity | ||
Date Created | 2024-09-10 | ||
Contributors | Harshvardhan J. Pandit | ||
See More: | section RULES in DPV |
Term | ObligationViolated | Prefix | dpv |
---|---|---|---|
Label | Obligation Violated | ||
IRI | https://w3id.org/dpv#ObligationViolated | ||
Type | rdfs:Class, skos:Concept, dpv:RuleFulfilmentStatus | ||
Broader/Parent types | dpv:RuleFulfilmentStatus → dpv:Status → dpv:Context | ||
Object of relation | dpv:hasContext, dpv:hasStatus | ||
Definition | Status indicating an obligation has been violated i.e. the activity stated as being required to be carried out has not been carried out and this is considered as a violation i.e. the activity can no longer be carried out to fulfil the obligation | ||
Date Created | 2024-09-10 | ||
Contributors | Harshvardhan J. Pandit | ||
See More: | section RULES in DPV |
Term | Permission | Prefix | dpv |
---|---|---|---|
Label | Permission | ||
IRI | https://w3id.org/dpv#Permission | ||
Type | rdfs:Class, skos:Concept, dpv:Rule | ||
Broader/Parent types | dpv:Rule | ||
Object of relation | dpv:hasFulfillmentsStatus, dpv:hasPermission, dpv:hasRule | ||
Definition | A rule describing a permission to perform an activity | ||
Examples | dex:E0028 :: Rule specifying permissiondex:E0066 :: Specifying permissions and prohibitions |
||
Date Created | 2022-10-19 | ||
Contributors | Harshvardhan J. Pandit, Georg P. Krog, Beatriz Esteves, Paul Ryan | ||
See More: | section RULES in DEX |
Term | PermissionNotUtilised | Prefix | dpv |
---|---|---|---|
Label | Permission Not Utilised | ||
IRI | https://w3id.org/dpv#PermissionNotUtilised | ||
Type | rdfs:Class, skos:Concept, dpv:RuleFulfilmentStatus | ||
Broader/Parent types | dpv:RuleFulfilmentStatus → dpv:Status → dpv:Context | ||
Object of relation | dpv:hasContext, dpv:hasStatus | ||
Definition | Status indicating a permission has not been utilised i.e. the activity stated as being permitted has not been carried out | ||
Date Created | 2024-09-10 | ||
Contributors | Harshvardhan J. Pandit | ||
See More: | section RULES in DPV |
Term | PermissionUtilised | Prefix | dpv |
---|---|---|---|
Label | Permission Utilised | ||
IRI | https://w3id.org/dpv#PermissionUtilised | ||
Type | rdfs:Class, skos:Concept, dpv:RuleFulfilmentStatus | ||
Broader/Parent types | dpv:RuleFulfilmentStatus → dpv:Status → dpv:Context | ||
Object of relation | dpv:hasContext, dpv:hasStatus | ||
Definition | Status indicating a permission has been utilised i.e. the activity stated as being permitted has been carried out | ||
Date Created | 2024-09-10 | ||
Contributors | Harshvardhan J. Pandit | ||
See More: | section RULES in DPV |
Term | Prohibition | Prefix | dpv |
---|---|---|---|
Label | Prohibition | ||
IRI | https://w3id.org/dpv#Prohibition | ||
Type | rdfs:Class, skos:Concept, dpv:Rule | ||
Broader/Parent types | dpv:Rule | ||
Object of relation | dpv:hasFulfillmentsStatus, dpv:hasProhibition, dpv:hasRule | ||
Definition | A rule describing a prohibition to perform an activity | ||
Examples | dex:E0029 :: Rule specifying prohibitiondex:E0066 :: Specifying permissions and prohibitions |
||
Date Created | 2022-10-19 | ||
Contributors | Harshvardhan J. Pandit, Georg P. Krog, Beatriz Esteves, Paul Ryan | ||
See More: | section RULES in DEX |
Term | ProhibitionFulfilled | Prefix | dpv |
---|---|---|---|
Label | Prohibition Fulfilled | ||
IRI | https://w3id.org/dpv#ProhibitionFulfilled | ||
Type | rdfs:Class, skos:Concept, dpv:RuleFulfilmentStatus | ||
Broader/Parent types | dpv:RuleFulfilmentStatus → dpv:Status → dpv:Context | ||
Object of relation | dpv:hasContext, dpv:hasStatus | ||
Definition | Status indicating a prohibition has been fulfilled i.e. the activity stated as being prohibited has not been carried out | ||
Date Created | 2024-09-10 | ||
Contributors | Harshvardhan J. Pandit | ||
See More: | section RULES in DPV |
Term | ProhibitionViolated | Prefix | dpv |
---|---|---|---|
Label | Prohibition Violated | ||
IRI | https://w3id.org/dpv#ProhibitionViolated | ||
Type | rdfs:Class, skos:Concept, dpv:RuleFulfilmentStatus | ||
Broader/Parent types | dpv:RuleFulfilmentStatus → dpv:Status → dpv:Context | ||
Object of relation | dpv:hasContext, dpv:hasStatus | ||
Definition | Status indicating a prohibition has been violated i.e. the activity stated as being prohibited has been carried out | ||
Date Created | 2024-09-10 | ||
Contributors | Harshvardhan J. Pandit | ||
See More: | section RULES in DPV |
Term | Rule | Prefix | dpv |
---|---|---|---|
Label | Rule | ||
IRI | https://w3id.org/dpv#Rule | ||
Type | rdfs:Class, skos:Concept | ||
Object of relation | dpv:hasFulfillmentsStatus, dpv:hasRule | ||
Definition | A rule describing a process or control that directs or determines if and how an activity should be conducted | ||
Examples | dex:E0030 :: Rule combining DPV with ODRL |
||
Date Created | 2022-10-19 | ||
Contributors | Harshvardhan J. Pandit, Georg P. Krog, Beatriz Esteves, Paul Ryan | ||
See More: | section RULES in DEX |
Term | RuleFulfilled | Prefix | dpv |
---|---|---|---|
Label | Rule Fulfilled | ||
IRI | https://w3id.org/dpv#RuleFulfilled | ||
Type | rdfs:Class, skos:Concept, dpv:RuleFulfilmentStatus | ||
Broader/Parent types | dpv:RuleFulfilmentStatus → dpv:Status → dpv:Context | ||
Object of relation | dpv:hasContext, dpv:hasStatus | ||
Definition | Status indicating a rule has been fulfilled, completed, or satisfied | ||
Date Created | 2024-09-10 | ||
Contributors | Harshvardhan J. Pandit | ||
See More: | section RULES in DPV |
Term | RuleFulfilmentStatus | Prefix | dpv |
---|---|---|---|
Label | Rule Fulfilment Status | ||
IRI | https://w3id.org/dpv#RuleFulfilmentStatus | ||
Type | rdfs:Class, skos:Concept | ||
Broader/Parent types | dpv:Status → dpv:Context | ||
Object of relation | dpv:hasContext, dpv:hasStatus | ||
Definition | Status associated with a rule for indicating whether it is applicable, or has been utilised, and whether the requirements of the rule have been fulfilled or violated | ||
Date Created | 2024-09-10 | ||
Contributors | Harshvardhan J. Pandit | ||
See More: | section RULES in DPV |
Term | RuleUnfulfilled | Prefix | dpv |
---|---|---|---|
Label | Rule Unfulfilled | ||
IRI | https://w3id.org/dpv#RuleUnfulfilled | ||
Type | rdfs:Class, skos:Concept, dpv:RuleFulfilmentStatus | ||
Broader/Parent types | dpv:RuleFulfilmentStatus → dpv:Status → dpv:Context | ||
Object of relation | dpv:hasContext, dpv:hasStatus | ||
Definition | Status indicating a rule has not been fulfilled nor violated | ||
Date Created | 2024-09-10 | ||
Contributors | Harshvardhan J. Pandit | ||
See More: | section RULES in DPV |
Term | RuleViolated | Prefix | dpv |
---|---|---|---|
Label | Rule Violated | ||
IRI | https://w3id.org/dpv#RuleViolated | ||
Type | rdfs:Class, skos:Concept, dpv:RuleFulfilmentStatus | ||
Broader/Parent types | dpv:RuleFulfilmentStatus → dpv:Status → dpv:Context | ||
Object of relation | dpv:hasContext, dpv:hasStatus | ||
Definition | Status indicating a rule has been violated, breached, broken, or infracted | ||
Date Created | 2024-09-10 | ||
Contributors | Harshvardhan J. Pandit | ||
See More: | section RULES in DPV |
Term | hasFulfillmentsStatus | Prefix | dpv |
---|---|---|---|
Label | has fulfillment status | ||
IRI | https://w3id.org/dpv#hasFulfillmentsStatus | ||
Type | rdf:Property, skos:Concept | ||
Broader/Parent types | dpv:hasStatus | ||
Sub-property of | dpv:hasStatus | ||
Domain includes | dpv:Context | ||
Range includes | dpv:Rule | ||
Definition | Specifying the fulfillment status associated with a rule | ||
Date Created | 2024-09-10 | ||
Contributors | Harshvardhan J. Pandit | ||
See More: | section RULES in DPV |
Term | hasObligation | Prefix | dpv |
---|---|---|---|
Label | has obligation | ||
IRI | https://w3id.org/dpv#hasObligation | ||
Type | rdf:Property, skos:Concept | ||
Broader/Parent types | dpv:hasRule | ||
Sub-property of | dpv:hasRule | ||
Domain includes | dpv:Context | ||
Range includes | dpv:Obligation | ||
Definition | Specifying applicability or inclusion of an obligation rule within specified context | ||
Date Created | 2022-10-19 | ||
Contributors | Harshvardhan J. Pandit, Georg P. Krog, Beatriz Esteves, Paul Ryan | ||
See More: | section RULES in DPV |
Term | hasPermission | Prefix | dpv |
---|---|---|---|
Label | has permission | ||
IRI | https://w3id.org/dpv#hasPermission | ||
Type | rdf:Property, skos:Concept | ||
Broader/Parent types | dpv:hasRule | ||
Sub-property of | dpv:hasRule | ||
Domain includes | dpv:Context | ||
Range includes | dpv:Permission | ||
Definition | Specifying applicability or inclusion of a permission rule within specified context | ||
Examples | dex:E0066 :: Specifying permissions and prohibitions |
||
Date Created | 2022-10-19 | ||
Contributors | Harshvardhan J. Pandit, Georg P. Krog, Beatriz Esteves, Paul Ryan | ||
See More: | section RULES in DEX |
Term | hasProhibition | Prefix | dpv |
---|---|---|---|
Label | has prohibition | ||
IRI | https://w3id.org/dpv#hasProhibition | ||
Type | rdf:Property, skos:Concept | ||
Broader/Parent types | dpv:hasRule | ||
Sub-property of | dpv:hasRule | ||
Domain includes | dpv:Context | ||
Range includes | dpv:Prohibition | ||
Definition | Specifying applicability or inclusion of a prohibition rule within specified context | ||
Examples | dex:E0066 :: Specifying permissions and prohibitions |
||
Date Created | 2022-10-19 | ||
Contributors | Harshvardhan J. Pandit, Georg P. Krog, Beatriz Esteves, Paul Ryan | ||
See More: | section RULES in DEX |
Term | hasRule | Prefix | dpv |
---|---|---|---|
Label | has rule | ||
IRI | https://w3id.org/dpv#hasRule | ||
Type | rdf:Property, skos:Concept | ||
Domain includes | dpv:Context | ||
Range includes | dpv:Rule | ||
Definition | Specifying applicability or inclusion of a rule within specified context | ||
Date Created | 2022-10-19 | ||
Contributors | Harshvardhan J. Pandit, Georg P. Krog, Beatriz Esteves, Paul Ryan | ||
See More: | section RULES in DPV |
DPV uses the following terms from [[RDF]] and [[RDFS]] with their defined meanings:
The following external concepts are re-used within DPV:
The following people have contributed to this vocabulary. The names are ordered alphabetically. The affiliations are informative do not represent formal endorsements. Affiliations may be outdated. The list is generated automatically from the contributors listed for defined concepts.
The DPVCG was established as part of the SPECIAL H2020 Project, which received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No. 731601 from 2017 to 2019.
Harshvardhan J. Pandit was funded to work on DPV from 2020 to 2022 by the Irish Research Council's Government of Ireland Postdoctoral Fellowship Grant#GOIPD/2020/790.
The ADAPT SFI Centre for Digital Media Technology is funded by Science Foundation Ireland through the SFI Research Centres Programme and is co-funded under the European Regional Development Fund (ERDF) through Grant#13/RC/2106 (2018 to 2020) and Grant#13/RC/2106_P2 (2021 onwards).
The contributions of Harshvardhan J. Pandit have been made with the financial support of Science Foundation Ireland under Grant Agreement No. 13/RC/2106_P2 at the ADAPT SFI Research Centre.