Gestão de riscos e controles internos no ensino superior: uma proposta de framework para uso e proteção de dados pessoais em uma instituição de ensino

Abstract

The General Data Protection Act, represents a change in the way privacy of individuals is treated, thus comprising a challenge for organizations of all segments. Therefore, this research proposes a conceptual and functional framework for compliance in a law. traditional higher education institution (HEI) in the city of São Paulo. The methodology adopted was the interventionist approach that approximates the theoretical dimension of practice, which benefits not only the institution, but also collaborates with the development of studies in a still unexplored sector, the educational. The work contributes to the understanding and compliance of the use and protection of personal data, in the order of 83% with the technical administrative teams, with articulated deliveries in a way that allows its replication in other areas not covered. Alignments are also aligned with the reference literature that asserts the still embryonic development of Risk Management and IT Governance mechanisms in the segment, similarly benefited, corroborated in a consonant and linear way by the high management of the HEI.