De crenças a intenções comportamentais de profissionais de tecnologia da informação para a conformidade: estudo com Design Science sobre aderência à lei geral de proteção de dados

Abstract

The third industrial revolution, of electronic and information technologies, is driven by the high power of connectivity, storage, processing and analysis of large volumes of data. However, there are human gaps in skills and knowledge necessary to meet these transformation proposals, generating insecurities and social pressures in the face of new challenges, including security and privacy of personal data, especially from the perspective of the General Data Protection Law (LGPD), in Brazil. The LGPD, like any law, establishes only a set of reference guidelines, exempting itself from providing precise explanations or effective practices, thus requiring specification through normative instructions, as well as situational decisions prepared by the organizations themselves, to guarantee the protection necessary for the privacy and security of data of its holders. Among the guidelines for compliance, there is the operator (Data Protection Officer – DPO), who is the natural person who aligns with the profile of an information technology (IT) professional. This alignment referred this study to the occupational culture of IT (ITOC – IT occupational culture), which arises, in part, from the interaction between the personal motivations of IT workers and the sharing of beliefs and behaviors. As the ITOC is formed by similar values, interests and attitudes that shape the perceptions of IT professionals, whose values represent the most fundamental beliefs, this study defends the thesis that the ITOC, in the face of catalytic organizational changes such as the LGPD, is formed by values, interests and attitudes that shape the perceptions of IT professionals via shared beliefs about compliance behavior, especially in the face of the new role of DPO, revealing new ITOC values or new implications. In this quest for compliance between organizations and legislation, recent studies, using purely computational tools, have highlighted the need to specify human actions. Thus, human compliance actions for the LGPD make up the interest of this study, which aimed to develop a design proposition (design proposition) for compliance behaviors with the LGPD. Therefore, Design Science was adopted as a conceptual approach and applied research methodology, as it has a prescriptive character for artifacts aimed at solving practical problems. The study participants were IT professionals, who answered a structured questionnaire with an emphasis on beliefs and intentions of compliance behavior, a questionnaire aimed at application in public and private organizations. Such a strategy proved to be effective in evidencing ITOC values distinct from those already present in the literature, thus supporting the thesis that the ITOC, in the face of catalytic organizational changes such as the LGPD, is formed by values, interests and attitudes that shape the perceptions of IT professionals through shared beliefs about conforming behavior and the emergence of a new occupation. Furthermore, this study specified 21 actions for LGPD compliance.