Tratamento dos dados pessoais nas universidades federais do Brasil : proposta de modelo de maturidade sob a perspectiva dos marcos legais brasileiros

Abstract

Technological advancement and contemporary challenges underscore the importance of responsibly handling personal data, given the risks and impacts associated with its improper use. Within public institutions, such as Brazilian federal universities, regulatory compliance faces specific difficulties, requiring practices aligned with the General Data Protection Law (LGPD) and other legal frameworks. This study aimed to develop and validate the Maturity Model for Personal Data Processing (MMTDP), designed to diagnose, plan, and improve practices. The research focused on the 69 federal universities in Brazil. Exploratory and descriptive, it adopted a qualitative-quantitative approach and was structured based on multiple case studies. The model's development followed steps grounded in specialized literature, normative analyses, and legislation, including LGPD. Validation was conducted using the Delphi method, involving experts in personal data protection, who contributed to adjustments and refinements in the measurement instrument. After validation, the practical application of MMTDP achieved 95.65% participation (66 institutions), enabling diagnoses that reveal gaps and improvements in personal data processing practices. The model, structured into five dimensions and five maturity levels, encompasses 25 questions in its measurement instrument, promoting regional and national comparative analyses, highlighting four representative universities with varying maturity levels. The research spanned from field delimitation to empirical validation, culminating in the analysis of results. Among the model's key contributions are its integration with strategic tools and its ability to drive continuous advancements in regulatory compliance and strategic data management. Therefore, MMTDP emerges as a robust instrument, capable of supporting federal universities in their pursuit of excellence, fostering safer and more transparent practices in personal data protection. Additionally, it strengthens governance and contributes to a culture of privacy and compliance in the public sector, serving as a reference for other institutions and research.