Description:

Organizations operating across multiple countries must comply with different legal, regulatory, and privacy requirements when collecting, processing, storing, and sharing data. Translating these often abstract and partly conflicting requirements into concrete technical and organizational measures remains a major challenge for system designers and decision-makers.

This thesis develops a generalizable framework or decision-support method for transforming country-specific privacy requirements into configurable system controls, such as data minimization, local processing, anonymization, access control, retention management, and automated deletion. Industrial video monitoring serves as an evaluation use case to assess how effectively the proposed approach supports the design of compliant cross-border data-processing architectures.