LGPD e conformidade nas organizações contábeis da Paraíba

Abstract

Technologies aimed at data processing are constantly evolving, combined with the intensive use of data, including personal data, as business drivers and a source of profits. Cases of corporate scandals, involving espionage, disclosure, use and commercialization of personal data held by organizations, contribute to the concern of governments with regulations that aim to encourage companies' commitment to transparency and governance for the protection of personal data under their custody . In this context, Brazil published in 2021 the General Law for the Protection of Personal Data (LGPD). This rule applies to accounting organizations that, in a special way, process their organization's data and, additionally, as part of their regular work, process personal data under the responsibility of their clients, culminating in the need to adapt internal governance to provide of the accounting service also focusing on the LGPD. The objective of this study is to identify the level of structuring of the requirements for compliance with the General Data Protection Law in accounting organizations registered with the Regional Accounting Council of Paraíba. Data collection was carried out through a questionnaire, which assessed the level of compliance with the LGPD requirements in 75 accounting organizations in Paraíba, subsequently evaluating them using a maturity scale.The analysis of the results identified in the governance pillar that 59% of accounting organizations do not establish the minimum precepts to be followed by data processing agents in the institution of a compliance program. The information security and asset protection pillar shows that 47% of accounting organizations recognize that they do not have the compliance required by the LGPD, and that adjustments are needed to improve the security of personal data. In assessing the compliance pillar, 62% of organizations do not have the adjustments required by the LGPD in the established requirements. In the general assessment of the pillars, it was identified that 86% of the organizations fit into an initial maturity level, that is, these organizations have not yet adopted measures that meet the structuring requirements determined by the LGPD, while 14% reach a maturity level of structured way, in which it was identified that the processes involving the processing of personal data happen in line with the requirements of the LGPD. Non compliance with legislation entails fines and sanctions and insecurity for its customers, with the company still at risk of reputational damage if it is involved in events of lack of security or data leakage.