LGPD-CHECK: Um Checklist para Avaliação da Aderência de Sistemas Computacionais à Lei Geral de Proteção de Dados Brasileira

Abstract

The General Data Protection Law (LGPD) was created to regulate the privacy and processing of personal data in Brazil. Although it became applicable in 2020, many software development teams still do not know what quality attributes are required for a system to comply with this law and avoid legal and monetary penalties. In addition, there are still no specific checklists in the literature to verify the quality criteria related to LGPD. In this master’s thesis, an inspection checklist is proposed to evaluate computer systems regarding their adherence to LGPD, called LGPD-CHECK. The proposal is based on the identification of the quality attributes of the LGPD law itself, and also of articles that describe the impact of the law on the development of Brazilian software systems and software systems to the laws of other countries, such as the GDPR. The inspection checklist contains a total of 56 attributes distributed in categories such as: transparency, legal rights, security, consent and responsibility, divided into mandatory items and recommended items. In a practical application in the industry, the inspection checklist was used by professionals who work with software development, to characterize and verify its feasibility of use. The participants carried out an inspection with the checklist, in a Private Innovation Institute, in a real computer system, which is implemented in small and medium-sized companies in several states of Brazil, performing the treatment and collection of data from sensors installed in industrial equipment, where it was of paramount importance to carry out an assessment of compliance with the LGPD. The professionals who acted as inspectors identified 42 defects that disrespect the LGPD, where the inspectors obtained 54.16% of effectiveness and an average efficiency (defects per hour) of 14.79. The results show initial evidence that the proposed checklist is viable for use, useful, easy to use, and finally, it fulfills its objective in identifying defects and evaluating the system’s adherence to the LGPD. In addition, the participants of the practical application in the industry reported that the checklist is complete, but requires a little mental effort, while they suggested to always keep it up to date at the expense of the law. Finally, the survey also presents an additional version of the inspection checklist, so that data subjects can assess the adequacy of their point of view. In this way, it is intended to provide support to organizations and software engineers, a reliable, robust and appropriate mechanism for detecting defects and assisting in the adequacy of computer systems to the LGPD.