Enhancing LGPD Compliance: A Specialized Checklist and Implementation Templates for Governmental Software Systems

Abstract

The Brazilian General Data Protection Law (LGPD) establishes guidelines for handling personal data. However, understanding and implementing the LGPD presents significant challenges for requirements analysts, particularly in identifying and operationalizing privacy requirements. This master’s thesis adapts, evaluates, and enhances the LGPDCheck checklist for use in public organizations. LGPD-Check is a method designed to assess software systems’ compliance with LGPD-mandated quality attributes, covering categories such as data transparency, user consent, user rights, data security, and controller responsibility. We improved the checklist by incorporating specific requirements demanded by the Federal Court of Accounts (TCU) and applied it within a government organization to assess its effectiveness. Our case study involved eight IT professionals. Results indicated that the checklist effectively supports the detection of defects in software systems and has led to significant enhancements of LGPD-Check. In addition to updating items and recommendations, we developed templates to assist inspectors in using the checklist. These templates provide guidance on addressing non-compliance issues and implementing improvements in the evaluated systems. Subsequently, we applied LGPD-Check to two real systems from a federal academic institution, which allowed us to discuss the benefits, challenges, and necessary refinements related to the recommendations and templates. Our findings revealed that 57.4% of the evaluated items did not meet legal standards, indicating substantial gaps in data protection processes and practices. Feedback from the focus group suggested that the revised checklist and templates help identify software compliance issues with the LGPD. Despite some limitations, such as the need for further studies to generalize the results and explore applications in other domains, our work contributes to enhancing LGPD compliance in software systems, particularly within the public sector.