Proteção de dados pessoais pelo poder público: um estudo de caso na UFRJ sob a ótica da Lei geral de proteção de dados (LGPD)

Abstract

This research analyzes the implementation of the LGPD (General Data Protection Law) at UFRJ, with the aim of identifying the progress and challenges in the compliance process with the law. Adopting a qualitative and exploratory methodology, the research is based on a literature review, legislative analysis, including the role of the National Data Protection Authority (ANPD), and a case study conducted through the observation of the activities of the first LGPD/UFRJ Working Group. The results of this study indicate that the implementation of the LGPD at UFRJ is at an intermediate stage, with progress in some areas, yet still far from full compliance. The LGPD/UFRJ Working Group has managed to carry out an initial assessment of the university's maturity in data protection, advance in mapping data processing procedures, produce regulatory documents and training materials, include privacy clauses in contracts, create a procedural type in the SEI system for security incidents, and initiate the dissemination of a data protection culture. However, the implementation faced significant challenges, such as resistance to change, lack of prioritization of compliance, complicated management transitions, staff shortages and high turnover, limited powers of the Working Group, difficulties in effective oversight, absence of proper institutionalization, lack of knowledge about existing databases, and insufficient support from the ANPD. The recommendations include the need to strengthen the data protection culture through continuous awareness efforts, invest in staff training as well as in the IT sector, urgently carry out a complete mapping of personal data, and improve the integration of systems and databases. Thus, this study provides an overview of the compliance efforts at UFRJ, offering practical recommendations for adaptation to the new legislation and serving as a reference for future research in the fields of digital government and data protection.