Conformidade de infraestrutura de TI com a LGPD no setor público : proposta de arquitetura de referência e processo de avaliação

Abstract

Introduction: The General Data Protection Law (LGPD) “emerged as a mechanism to regulate the processing of personal data in the national territory, guaranteeing the fundamental rights of freedom and privacy of any natural person whose data is processed here”. Objectives: To propose a reference model and an evaluation process for IT infrastructure compliance with the LGPD in the public IT sector. Methodology: This is an exploratory research of case study type. The present research has as methodological procedures, bibliographic analysis of the topic and implementation of a data validation system, with the aim of carrying out the proposal of the reference architecture in the evaluation process in compliance with personal data to prevent improper sharing without authorization, in accordance with the current LGPD legislation. Results: Company C: Total Responses: 158 (YES) + 41 (NO) = 199; percentage of "YES": (158 / 199) * 100 = 79.40%; Classification: Since 79.40% is greater than or equal to 70%, Company Y is classified as: COMPLIANT. Company D: Total Responses: 89 (YES) + 53 (NO) = 142; percentage of "YES": (89 / 142) * 100 = 62.68%; Classification: Since 62.68% is between 60% and 69.99%, Company X is classified as: PARTIALLY COMPLIANT. Conclusion: The proposal of this work is of great relevance to the public sector, especially IT infrastructure, since some significant changes are based on actions to increase technological infrastructure. It is worth mentioning that this model is a basis for the production of an instrument to verify LGPD compliance in public organizations, and should still be validated in a case study.