Understanding, describing, and mitigating the flow of personal data in ROS 2 systems to comply with the GDPR and beyond.*

With the introduction of privacy protection laws such as the GDPR in the EU, carrying out privacy impact assessments (PIA) for new robotics applications interacting with humans is becoming a necessary part of the development process. We discuss a methodology and develop and release software [1] to describe and mitigate the flow of personal data as part of the development process or retroactively in the Robot Operating System - ROS 2.