Privacy as Permissible Operations: An ABAC Framework for Policy-Law Compliance

2026-04-12

AI Summary

This work addresses the challenge of efficiently verifying whether corporate privacy policies comply with data protection laws. It proposes APLiance, a novel framework that formalizes legal compliance as an attribute-based access control (ABAC) authorization decision: by semantically mapping privacy policy clauses into implicit access requests and checking whether they are permitted under an ABAC policy modeled from legal provisions. Integrating natural language processing with access control mechanisms, the approach enables automated compliance verification. Empirical evaluation in the context of India’s Digital Personal Data Protection Act demonstrates its effectiveness, and the authors release an open-source browser extension that allows users to assess the legal compliance of website privacy policies in real time.

Technology Category

• Machine Learning: Privacy
• Natural Language Processing: Ethics — Bias, Fairness, Transparency & Privacy
• Humans and AI: AI for Accessibility

Application Category

• Responsible Web: Data and user privacy-enhancing technologies for the Web
• Security and Privacy: Data transparency and provenance
• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems

Abstract

In recent years, many countries have started enacting laws to safeguard privacy of personal data of their citizens collected and maintained by various enterprises through websites, mobile apps, and other means. It is imperative that the privacy policies of these enterprises respect the provisions of the applicable law. In this paper, we show how such organizational privacy policies can be efficiently checked against a prevalent law. Our novel approach named APLiance (\underline{A}BAC framework for \underline{P}olicy-\underline{L}aw Compl\underline{iance}) models the requirements of the different sections of a privacy law in the form of Attribute-based Access Control (ABAC) rules and the clauses of a privacy policy as a sequence of implied access requests. A policy is considered to be compliant with the law if these access requests are permitted by the corresponding ABAC rules. Although APLiance can be used in any policy-law setting, we demonstrate its effectiveness in the context of the recently introduced Digital Personal Data Protection Act of India. A browser plugin has been developed and publicly released for real time compliance checking using APLiance whenever a user visits the privacy policy page of a website.

Problem

• privacy policy
• law compliance
• data protection
• ABAC
• policy verification

Innovation

• ABAC
• policy-law compliance
• privacy policy
• automated compliance checking
• Digital Personal Data Protection Act