  This paper elaborates the use of static source code analysis in the context
of data protection. The topic is important for software engineering in order
for software developers to improve the protection of personal data during
software development. To this end, the paper proposes a design of annotating
classes and functions that process personal data. The design serves two primary
purposes: on one hand, it provides means for software developers to document
their intent; on the other hand, it furnishes tools for automatic detection of
potential violations. This dual rationale facilitates compliance with the
General Data Protection Regulation (GDPR) and other emerging data protection
and privacy regulations. In addition to a brief review of the state-of-the-art
of static analysis in the data protection context and the design of the
proposed analysis method, a concrete tool is presented to demonstrate a
practical implementation for the Java programming language.
