Compliance Requirements in Large-Scale Software Development: An Industrial Case Study
It provides incremental empirical insights for software engineering practitioners dealing with compliance in large-scale industrial settings.
The paper tackles the lack of empirical evidence on regulatory compliance challenges in industrial software development by conducting a case study at Ericsson AB, identifying common practices and issues related to standards like GDPR.
Regulatory compliance is a well-studied area, including research on how to model, check, analyse, enact, and verify compliance of software. However, while the theoretical body of knowledge is vast, empirical evidence on challenges with regulatory compliance, as faced by industrial practitioners particularly in the Software Engineering domain, is still lacking. In this paper, we report on an industrial case study which aims at providing insights into common practices and challenges with checking and analysing regulatory compliance, and we discuss our insights in direct relation to the state of reported evidence. Our study is performed at Ericsson AB, a large telecommunications company, which must comply to both locally and internationally governing regulatory entities and standards such as GDPR. The main contributions of this work are empirical evidence on challenges experienced by Ericsson that complement the existing body of knowledge on regulatory compliance.