PDAgro: uma ferramenta de diagnóstico de conformidade à LGPD

Abstract

In the face of technological advancements, personal data analyzed become highly valuable in decision-making in business, but the lack of attention of operations caused incidents led to the exposure of data for 243 million brasilians, according to Axur (2018) report, affects the privacy of personal data belonging to individuals who have the ability to determine its use. In 2016, data protection started to be guaranteed with the approval of the General Data Protection Regulation (GDPR) in the European Union, EUROPEAN PARLIAMENT (2016). In Brazil, the General Data Protection Law (LGPD) was approved in 2018 and was already being used with the NBR ISO/IEC 27001 for information security management and the ISO/IEC 27002 for good practices in information security management. A Constitutional (EC 115) included data protection to a constitutional right, becoming part of the fundamental rights and the same year also saw the launch of the LGPD Guideline for the agriculture sector, which identified the difficulty that small and medium-sized businesses face in adapting to the law (STEFANI, 2023). Based on the law and NBR ISO/IEC 27701/2019, the diagnosis of compliance with the LGPD was developed called PDAgro - Privacy of Data in Agrotrade - a specialist system which uses good practices and governance, integrated with an adaptation of the organizational performance evaluatiuon tool, the Balanced Scorecard (BSC), in 4 dimensions: Processes, Legal/regulatory, Technology and Learning. The study results led to equations and classification in belts, based on a set of standards the manage to define the compliance point of the LGPD for a company. The proposal was validated in the qualification with a set of 11 agribusiness companies that verified their businesses compliance using an electronic form, obtaining a 0.89 Cronbach’s alpha coefficient of reliability, and at the end, they received recommendations via email. Subsequently, the tool https://www.pdagro.com was validated with 17 companies: 10 first-time respondents and 7 respondents who had a second diagnosis, in which it was evident that the majority of companies achieved the exchange of belts after adopting the recommended good practices. Regarding the usability of the PDAgro tool, it stands out that 88.2% of users indicated that they learned more about data protection, 94.1% of companies’ responses show that the diagnosis is aligned with their realities, indicating that the results were relevant to the goals, as well as being a repository for data protection.