goodFlows is a product of several years of research and development~\cite{papagiannakopoulou2014phd}\cite{koukovini2014phd}, that has matured in the context of the H2020 BPR4GDPR project\footnote{\url{https://www.bpr4gdpr.eu/}}~\cite{Lioudakis2021}. It has been conceived as a holistic framework designed to aid organisation of various sizes in ensuring compliance with the General Data Protection Regulation (GDPR)~\cite{eu-gdpr}; it ensures that processes, and workflows in general, are automatically aligned with both organisational goals and GDPR requirements, by design and by default. In more detail, goodFlows enables organisations to formally define their information model in sufficient detail, with a strong emphasis on concepts and assets relevant to GDPR. On the basis of this information model, it allows for the definition of policies containing any applicable GDPR-related rules as adapted to the specific needs of the organisation, in a user-friendly, flexible, and fine-grained way. Processes and workflows can be modelled using an easy-to-use no-code design and editing tool, which supports automatic verification of whether a workflow model is GDPR-compliant; where possible, non-compliant workflow models can be automatically transformed into compliant ones.

The framework is steered by two main pillars: a rule-based access and usage control framework, and a system for compliant workflow planning and re-engineering (Figure~\ref{fig:goodflows-arch}).
The former comprises a Policy Decision Point (PDP) that, based on the afore-mentioned organisational information model, performs all reasoning required for taking authorisation decisions and driving the workflow verification and re-engineering towards compliance performed by the latter.
%generating data governance structures, expressed in ODRL, and

Underpinning this, there are three foundational models, implemented as semantic ontologies (Figure~\ref{fig:ontologies}): the information model, the policy model, and the workflow model. Reasoning in the policy model results in the formation of \textit{Compliance Directives}, being ontological structures used to regulate the verification and transformation procedure~\cite{bpr4gdprD41}.
Together, these elements form an integrated environment that facilitates the development and maintenance of compliant, privacy-aware business processes and workflows.


\begin{figure}[!htb]
	\centering
	\includegraphics[width=1\linewidth]{figs/goodflows-arch}
	\caption{goodFlows concept (dashed rectangles highlight contribution of this work)}
	\label{fig:goodflows-arch}
\end{figure}

\begin{figure}[!htb]
	\centering
	\includegraphics[width=0.65\linewidth]{figs/ontologies}
	\caption{goodFlows models and ontologies}
	\label{fig:ontologies}
\end{figure}

However, goodFlows was characterised by two limitations. On the one hand, there was no means to import and align standard ontologies. On the other hand, whereas goodFlows' PDP allowed for complex reasoning, it was lacking the mechanisms to import and take into consideration the constraints of data subjects and data holders, thereby resolving conflicts between these constraints and internal policies and workflows. These two limitations have motivated this work, and the results towards their resolution are presented in this paper.