
Privacy-Paerns for IoT Application Developers
NADA ALHIRABI, Cardi University, UK and King Saud University, Saudi Arabia
STEPHANIE BEAUMONT, My Data Fix Ltd, UK
OMER RANA, Cardi University, UK
CHARITH PERERA, Cardi University, UK
Designing Internet of things (IoT) applications (apps) is challenging due to the heterogeneous nature of the systems on which these
apps are deployed. Personal data, often classied as sensitive, may be collected and analysed by IoT apps, where data privacy laws
are expected to protect such information. Various approaches already exist to support privacy-by-design (PbD) schemes, enabling
developers to take data privacy into account at the design phase of application development. However, developers are not widely
adopting these approaches because of understandability and interpretation challenges. A limited number of tools currently exist to
assist developers in this context – leading to our proposal for “PARROT" (PrivAcy by design tool foR inteRnet Of Things). PARROT
supports a number of techniques to enable PbD techniques to be more widely used. We present the ndings of a controlled study and
discuss how this privacy-preserving tool increases the ability of IoT developers to apply privacy laws (such as GDPR) and privacy
patterns. Our students demonstrate that the PARROT prototype tool increases the awareness of privacy requirements in design and
increases the likelihood of the subsequent design to be more cognisant of data privacy requirements.
CCS Concepts:
•Security and privacy →
Usability in security and privacy;
•Human-centered computing →
Ubiquitous and
mobile computing design and evaluation methods.
Additional Key Words and Phrases: Internet of Things; Privacy by Design; Privacy Patterns; Software Design; Software Developers;
Data Protection; Privacy Law; GDPR; Usable Privacy; Privacy Practices
ACM Reference Format:
Nada Alhirabi, Stephanie Beaumont, Omer Rana, and Charith Perera. 2022. Privacy-Patterns for IoT Application Developers. In
Proceedings of the 2022 ACM International Joint Conference on Pervasive and Ubiquitous Computing (UbiComp/ISWC ’22 Adjunct),
September 11–15, 2022, Cambridge, United Kingdom. ACM, New York, NY, USA, 4 pages. https://doi.org/10.1145/3544793.3560333
1 Introduction
Internet of Things (IoT) applications generate and process a large amount of data that are transmitted between devices.
As the size and frequency of this data increase, an ecient architecture is needed to manage and process this data [
6
].
Many eorts have been made to support privacy in the early stage of software development, such as Privacy-by-Design
(PbD) principles by Cavoukian [
3
]. However, many developers are unaware of the potentially signicant privacy issues
in an online context – nding it time-consuming and challenging to understand privacy policies and their implications
for their work [
4
]. Moreover, privacy concerns for a specic app design or implementation are rarely discussed by
developers [
7
]. This indicates a need for a privacy tool to reduce the operational and implementation gap between
software developers and privacy requirements [1].
The PARROT tool oers intuitive and user-friendly interfaces to assist and educate software developers on how to
learn and include privacy in their system design [
2
]. Initially, the tool was built for the highly regulated domain of
Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not
made or distributed for prot or commercial advantage and that copies bear this notice and the full citation on the rst page. Copyrights for third-party
components of this work must be honored. For all other uses, contact the owner/author(s).
©2022 Copyright held by the owner/author(s).
Manuscript submitted to ACM
1
arXiv:2210.01853v1 [cs.CR] 4 Oct 2022