這篇論文探討在物聯網設備日益普及的情況下，如何因應《一般資料保護規則》所帶來的合規挑戰。一般資料保護規則要求資料控制者必須保護個人資料，並取得當事人的明確同意。然而，現有的集中式處理方式往往形成不透明的「黑箱」系統，導致隱私資料容易被濫用。雖然近期已有解決方案，嘗試利用區塊鏈紀錄當事人的授權以進行存取控制，但這些方法多只著重在交易層面的區塊鏈運作，忽略了使用者設備實際仍由企業控制，使得黑箱問題依然存在。
為了解決這些問題，我們提出了一種全新的方法——資料保護守衛。這是一種透明的「白箱」方案，將控制權由企業轉移至使用者，提升整體透明度與問責性。資料保護守衛涵蓋了設備整個生命週期的稽核，包括製造階段，這是現有解決方案常被忽略的部分。監管機關將參與設備製造監督，確保每台設備都內建安全的資料保護守衛元件，以記錄經過認證的製造資訊、受控的應用程式部署、可靠的設備所有權轉讓、以用戶同意為前提的資料收集與應用程式更新，並透過防竄改的數位簽章確保記錄的真實性。
本論文也提出一套完整的存取控制與稽核協定，並實作了概念驗證原型，結合具體完整的威脅模型進行安全性評估，證明本方案在一般資料保護規則合規上具有良好的可靠性與可接受的效能表現。

This paper addresses the challenges of General Data Protection Regulation (GDPR) compliance posed by the growing prevalence of Internet of Things (IoT) devices, which exacerbate privacy concerns. GDPR mandates data controllers to protect personal data and requires explicit consent for data processing, but centralized approaches create opaque black box systems prone to misuse. Although recent solutions utilize blockchain for access control by recording data subject consents, they focus solely on transaction-level activities, but overlook user devices controlled by enterprises, leaving black box issues unresolved. To address these challenges, we propose data protection guard (GDPR-Guard), a novel transparent white box solution that shifts control from enterprises to users, enhancing transparency and accountability by auditing the entire device lifecycle, including manufacturing, which existing solutions often neglect. The supervisory authority oversees manufacturing, ensuring each device integrates a secure GDPR-Guard to log certified device manufacture, controlled application deployment, reliable ownership transfer, and consent-based data collection or application update using tamper-proof digital signatures. This enables reliable investigations throughout the device's lifecycle. The paper also offers a comprehensive access control and auditing protocol, presents a proof-of-concept implementation, evaluates security with concrete threat models, and demonstrating the reliability and acceptable performance of the solution for GDPR compliance.