A multicriteria model to support decisions regarding data protection compliance

ABSTRACTWith the advent of the General Personal Data Protection Law (LGPD) in Brazil, companies need to adapt to the law and, therefore, must identify weaknesses in relation to the protection of personal data. Next, actions are defined that include investments in technology, infrastructure and training. These actions require resources, either for the implementation of some technology or readjustment of the system, time for implementation, restructuring of processes, and involvement of key people. Considering these actions can also impact the organizational strategy, this work proposes a model to support the prioritization of actions necessary to comply with the LGPD. The model is based on the FITradeoff (Flexible and Interactive Tradeoff) multicriteria method. The proposed model was applied in a Brazilian organization that is adapting to the LGPD and needed formal support in relation to decisions. The recommendations obtained demonstrated alignment with the company's needs and strategies.KEYWORDS: Data protection; compliancemulticriteria decisionfitradeoff AcknowledgmentsThe authors would like to acknowledge the National Council for the Improvement of Higher Education (CAPES) and the Brazilian Research Council (CNPq) Brazilian National Research Council (CNPq), under Grant 311197/2020-5, for the support received to develop this research.Disclosure statementNo potential conflict of interest was reported by the author(s).