OASIS provides us with a template for the systematic analysis of systems that process personal data.

OASIS (Organization for the Advancement of Structured Information Standards) hosts a technical committe that works on the OASIS Privacy by Design Documentation for Software Engineers (PbD-SE). Although the documentation is not yet finished, its draft version is available at the OASIS web page (external link).

In this document, the authors elaborate how a use case or business case shall get analyzed in a structured 12-step process supported by the "Privacy by Design Use Case Template for Privacy Requirements". The result of the analysis is a privacy requirements specification. Step by step, analysts will assess a use case, the involved stakeholders, the personal data and data flows, and then finally specify the necessary policies and functions. Figure 1 below illustrates the 12 steps of the analysis template.

Below in the table, you find the Privacy by Design Use Case Template for Privacy Requirements including comments on the use of the template.The template is used by privacy engineers and system owners to discuss the use case, the data subjects and the processed personal data in connection to to systems used to process the personal data. The "description" column is used to document the findings.

#	Step	Description
1	Use Case Title
2	Use Case Category
3	Use Case Description
4	Applications associated with Use Case Relevant applications and products requiring software development where personal data is communicated, created, processed, stored or deleted
5	Data subjects associated with Use Case Includes any data subjects associated with any of the applications in the use case
6	PI and PII and the legal, regulatory and /or business policies governing PI and PII in the Use Case The PI and PII collected, created, communicated, processed, stored or deleted within privacy domains or systems, applications or products The policies and regulatory requirements governing privacy conformance within use case domains or systems and links to their sources
7	Domains, Domain Owners, and Roles associated with the Use Case – Definitions: Domains - both physical areas (such as a customer location or data center location) and logical areas (such as a wide-area network or cloud computing environment) that are subject to the control of a particular domain owner Domain Owners - the participants responsible for ensuring that privacy controls and functional services are defined or managed in business processes and technical systems within a given domain Roles - the roles and responsibilities assigned to specific participants and systems within a specific privacy domain
8	Data Flows and Touch Points Linking Domains or Systems Touch points - the points of intersection of data flows with privacy domains or systems within privacy domains Data flows – data exchanges carrying PI and privacy policies among domains in the use case
9	Systems supporting the Use Case applications System - a collection of components organized to accomplish a specific function or set of functions having a relationship to operational privacy management
10	Privacy controls required for developer implementation Control - a process designed to provide reasonable assurance regarding the achievement of stated objectives [Note: to be developed against specific domain, system, or applications as required by internal governance policies, business requirements and regulations
11	Services Service - a collection of related functions and mechanisms that operate for a specified purpose
12	Underlying functionality

References

Annex to the Privacy by Design Documentation for Software Engineers Version 1.0, Edited by Ann Cavoukian, Fred Carter, Dawn Jutla, John Sabo, Frank Dawson, Jonathan Fox, Tom Finneran, Sander Fieten, 25 June 2014.OASIS Committee Note 01. [link]