Towards Privacy and Security Compliance in Food and Nutrition Data Lakes

Although many domain-specific data lakes excel in scalability and performance, they often treat privacy and ethics as afterthoughts, risking regulatory noncompliance and stakeholder distrust. To bridge this gap, we designed, implemented, and validated two iterations of a GDPR compliant Food and Nutrition Data Lake—FOODITY (public, open access) and SOS Food (closed access)—that together demonstrate scalable, secure food and nutrition data sharing. Threats are identified via OWASP-aligned attack tree modelling. To mitigate the risks, our data lake enforces provider-side anonymization and integrates AI-driven modules alongside regular expression filters to detect residual Personally Identifiable Information (PII) at the data ingestion stage. Therefore, our GDPR compliant data lakes are a reproducible blueprint for sustainable, equitable food systems.