  Ensuring compliance with the General Data Protection Regulation (GDPR) is a
crucial aspect of software development. This task, due to its time-consuming
nature and requirement for specialized knowledge, is often deferred or
delegated to specialized code reviewers. These reviewers, particularly when
external to the development organization, may lack detailed knowledge of the
software under review, necessitating the prioritization of their resources.
  To address this, we have designed two specialized views of a codebase to help
code reviewers in prioritizing their work related to personal data: one view
displays the types of personal data representation, while the other provides an
abstract depiction of personal data processing, complemented by an optional
detailed exploration of specific code snippets. Leveraging static analysis, our
method identifies personal data-related code segments, thereby expediting the
review process. Our approach, evaluated on four open-source GitHub
applications, demonstrated a precision rate of 0.87 in identifying personal
data flows. Additionally, we fact-checked the privacy statements of 15 Android
applications. This solution, designed to augment the efficiency of GDPR-related
privacy analysis tasks such as the Record of Processing Activities (ROPA), aims
to conserve resources, thereby saving time and enhancing productivity for code
reviewers.
