Integrando a lei geral de proteção de dados ao desenvolvimento de software: um novo modelo de especificação de requisitos aplicado na saúde digital

Abstract

This research addresses the problem of insufficient requirements specification to meet compliance demands in software development, highlighting the importance of integrating legal requirements, such as those of the LGPD, into the development process. The overall aim of this work is to develop a new requirements specification model that meets the LGPD in the context of agile development. This model aims to establish a Requirements Engineering strategy that provides compliance with the LGPD, facilitating its practical application in software development. In addition, the model should have an educational character, being useful for students and teachers, allowing a practical integration of the concepts of privacy and data protection in both development and teaching processes. The methodology of this research was divided into three parts: (1) Requirements Identification and Specification Model Structuring Phase; (2) Audience Definition and Assessment Instruments Phase; and (3) Assessment Presentation and Application Phase. The model was applied to examples in the context of Digital Health. To evaluate the model, an evaluation tool was developed for two profiles of participants (information technology professionals and teachers). We obtained a total of 24 responses to the forms. The results show that the adoption of the requirements specification model can be favorable, as it has the potential to help identify and effectively communicate requirements suitable for the GDPR to agile development teams, facilitating compliance with legal requirements and data protection. In addition, an important educational potential was identified in the model, as the participating teachers assessed that it can be used as a suitable tool for teaching about requirements and the GDPR in the classroom.