---
_id: '67397'
abstract:
- lang: eng
  text: Android applications collecting data from users must comply with legal frameworks
    to ensure data protection. This requirement has become even more important since
    the implementation of the General Data Protection Regulation (GDPR) by the European
    Union in 2018. In practice, GDPR compliance involves conducting effective privacy
    assessments, requiring close collaboration between stakeholders with diverse expertise-including
    developers, privacy experts, legal experts, and auditors. This thesis introduces
    a multi-layered definition of privacy-related data, grounded in GDPR’s notion
    of personal data, and presents Privacy-Relevant Input Classification Engine (PRICE),
    a command-line tool for statically labeling privacy-related data collected by
    Android apps. Using PRICE, we examine data collection patterns across Android
    apps and assess how accurately these apps report their data collection practices.
    Our analysis reveals that apps most frequently collect data capable of partially
    identifying users, highlighting the need for greater consistency in privacy-aware
    development and reporting. Complementing this analysis, we investigate developers’
    experiences with Google Play Store’s Data Safety Section (DSS) through a survey
    and analysis of online developer discussions. This study identifies key challenges
    developers face in completing the DSS, including difficulties in identifying privacy-related
    data and limited understanding of the form.Building on these findings, the thesis
    explores how static program analysis can be used to automate and support privacy
    assessments. We introduce Assessor View, a static analysis-based web tool designed
    to assist multiple stakeholders involved in privacy evaluations. Assessor View
    provides a unified view of privacy-related dataflows and supports collaboration
    across technical and non-technical roles. Qualitative evaluations with technical
    and legal participants indicate that the tool’s warnings and guidance are valuable
    to Data Protection Officers and privacy experts,representing a significant step
    toward improving communication between legal and technical experts and streamlining
    privacy assessments. Finally, we extend both PRICE and Assessor View to more directly
    support stakeholder needs by enabling accurate, source code-driven report generation.
    These extensions aim to reduce manual effort, improve consistency between implemented
    behavior and reported disclosures, and support reliable and transparent privacy
    assessments. Collectively, these contributions advance the state of the art in
    privacy-aware software engineering and provide a foundation for more systematic,
    automated, and legally compliant privacy assessments of Android applications.
author:
- first_name: Mugdha
  full_name: Khedkar, Mugdha
  id: '88024'
  last_name: Khedkar
citation:
  ama: Khedkar M. <i>Assisting GDPR Compliance through Static Analysis of Android
    Apps</i>. Paderborn University; 2026. doi:<a href="https://doi.org/10.17619/UNIPB/1-2735">https://doi.org/10.17619/UNIPB/1-2735</a>
  apa: Khedkar, M. (2026). <i>Assisting GDPR Compliance through Static Analysis of
    Android Apps</i>. Paderborn University. <a href="https://doi.org/10.17619/UNIPB/1-2735">https://doi.org/10.17619/UNIPB/1-2735</a>
  bibtex: '@book{Khedkar_2026, title={Assisting GDPR Compliance through Static Analysis
    of Android Apps}, DOI={<a href="https://doi.org/10.17619/UNIPB/1-2735">https://doi.org/10.17619/UNIPB/1-2735</a>},
    publisher={Paderborn University}, author={Khedkar, Mugdha}, year={2026} }'
  chicago: Khedkar, Mugdha. <i>Assisting GDPR Compliance through Static Analysis of
    Android Apps</i>. Paderborn University, 2026. <a href="https://doi.org/10.17619/UNIPB/1-2735">https://doi.org/10.17619/UNIPB/1-2735</a>.
  ieee: M. Khedkar, <i>Assisting GDPR Compliance through Static Analysis of Android
    Apps</i>. Paderborn University, 2026.
  mla: Khedkar, Mugdha. <i>Assisting GDPR Compliance through Static Analysis of Android
    Apps</i>. Paderborn University, 2026, doi:<a href="https://doi.org/10.17619/UNIPB/1-2735">https://doi.org/10.17619/UNIPB/1-2735</a>.
  short: M. Khedkar, Assisting GDPR Compliance through Static Analysis of Android
    Apps, Paderborn University, 2026.
date_created: 2026-10-05T11:14:16Z
date_updated: 2026-10-05T11:15:07Z
department:
- _id: '76'
doi: https://doi.org/10.17619/UNIPB/1-2735
language:
- iso: eng
publisher: Paderborn University
status: public
supervisor:
- first_name: Eric
  full_name: Bodden, Eric
  id: '59256'
  last_name: Bodden
  orcid: 0000-0003-3470-3647
title: Assisting GDPR Compliance through Static Analysis of Android Apps
type: dissertation
user_id: '88024'
year: '2026'
...