Política e gestão da informação no contexto da LGPD: a perspectiva da auditoria de informação para o registro do tratamento de dados pessoais

Abstract

The objective, with this bibliographic and documentary study, is to build theoretical and methodological support to expand the Personal Data Inventory (IDP) model based on information audit criteria, to assist controllers and operators in Brazilian’s Data General Protection Law application. It is characterized as qualitative research of an applied nature, with exploratory and descriptive objectives. An integrative literature review was used with direct qualitative content analysis to prepare and apply a checklist, in order to indicate elements of information audit methods to integrate the IDP, expanding the model presented by Brazilian Central Data Governance Committee. As a result, there was a lower demand in the IDP for information regarding the following audit elements: organizational context, information environment, information flows, technological resources, information services and, mainly, cost/value of information. It concludes that the inclusion of information audit elements in the IDP can enhance the accuracy and completeness of the data processing record carried out by the controller, as this information management tool provides a well-founded assessment of how the organization is treating the personal data collected, where they are, what they are and the operations that are performed with this data.