A Comprehensive Review of Techniques, Methods, Processes, Frameworks, and Tools for Privacy Requirements

Context: Requirements Engineering (RE) relies on the collaboration of various roles—such as requirements engineers, stakeholders, and developers—and various techniques, methods, processes, frameworks, and tools. This makes RE a highly human-dependent process that benefits greatly from tool support. Understanding how these techniques, methods, processes, frameworks, and tools are applied across RE phases could provide valuable insights into ways to enhance the RE process, contributing to more successful outcomes. Objective: The primary objective of this study is to identify the techniques, methods, processes, frameworks, and tools applied across different requirements engineering phases—such as elicitation, analysis, specification, validation, and management—to address privacy requirements. Method: We conducted a systematic literature review (SLR) and identified 125 primary studies, and we also conducted a survey with 37 practitioners. Results: Our review identified a range of techniques, methods, processes, frameworks, and tools for addressing privacy requirements. Most studies were conducted in academic contexts, with the most frequently used tools being: PriS Method, Secure Tropos, LINDDUN, i* (i-star), STRAP (Structured Analysis for Privacy), Privacy by Design (PbD), and SQUARE. Additionally, over 75% of the studies applied these tools in the privacy requirements elicitation phase. In the industry, most of the techniques identified in the literature are not known or used by practitioners. Conclusion: This study provides a comprehensive analysis of techniques and tools for privacy requirements in RE, revealing a strong focus on academic contexts with limited industry application. Future research should explore the scalability and effectiveness of these tools in real-world environments, as well as the reasons why practitioners do not use them.背景：需求工程（Requirements Engineering, RE）依赖于各类角色的协同工作，包括需求工程师、涉众与开发人员等，同时搭配各类技术、方法、流程、框架与工具。这使得需求工程成为高度依赖人力的流程，且可从工具支持中获取极大增益。明晰上述技术、方法、流程、框架及工具在需求工程各阶段的应用模式，可为优化需求工程流程提供宝贵洞见，助力达成更理想的项目成果。 目标：本研究的核心目标是，识别出在需求工程各阶段（包括需求获取、需求分析、需求规格说明、需求验证与需求管理）中用于处理隐私需求的各类技术、方法、流程、框架与工具。 方法：本研究开展了系统性文献综述（Systematic Literature Review, SLR），筛选纳入125项原始研究；同时面向37名行业从业者开展了问卷调查。 结果：本综述筛选出一系列用于处理隐私需求的技术、方法、流程、框架与工具。其中绝大多数研究均在学术场景中开展，使用频率最高的工具包括：PriS方法（PriS Method）、Secure Tropos、LINDDUN、i*（i-star）、STRAP（隐私结构化分析，Structured Analysis for Privacy）、设计式隐私（Privacy by Design, PbD）以及SQUARE。此外，超过75%的研究将这些工具应用于隐私需求获取阶段。而在工业实践中，文献中提及的多数技术并未被从业者知晓或实际应用。 结论：本研究对需求工程领域中用于隐私需求处理的技术与工具开展了全面分析，结果显示当前研究多集中于学术场景，工业界应用较为有限。未来研究可探索这些工具在真实场景中的可扩展性与有效性，以及从业者未采用这些工具的深层原因。