EPIC: Analisador de Conformidade com a LGPD para Processos e Informações de Empresas

Abstract

In a scenario where personal data is of great importance for economic development, a concern about the processing of these data and privacy protection arises in a way that does not interfere with freedom of information. In Brazil, the General Data Protection Law has been in force since August 2020. Many companies, especially the Small and Medium Business (SMB) ones, are still adapting, becoming useful means for the dissemination of knowledge of the law and its applicability. The objective of this research was to develop a software solution, in compliance with the General Data Protection Law (LGPD), that helps companies to map their processes and information in order to increase the security level of these data and alerting about the critical levels of these information. The development methodology of this paper was based on the deductive method, being quantitative in relation to the approach of the problem, descriptive and explanatory as to the basis of the objectives, and related to the technical procedures is bibliographical and survey. From the theoretical references studied and from Systematic Literature Review (SLR), was proposed a software solution through an mapping process to analysis data security approach, intending to help the SMB companies to be compliant to LGPD. For this, the tool was modeled, developed, tested and, finally, validated with real SMB companies. Afterwards, a questionnaire was applied in order to obtain the users feedback and profile. The results of the information security indexes obtained show that companies in the Information Technology (IT) sector are those with moderate and high levels and that, in general, the companies still need to adopt basic security measures. The non-compliance rates obtained by the companies show that most, even IT companies, still need to adapt a large part of their processes to the LGPD. Regarding the usability of the EPIC, most of the results obtained the maximum degrees of satisfaction according to the aspects questioned. Knowing that most users stated that the analysis provided by EPIC fully corresponds to the company’s reality, it is assumed that the developed tool presents results consistent with what was proposed. Finally, most companies responded that they would indicate, certainly, EPIC for other companies, which corroborates the proposal of the tool.