Structuring Privacy and Information Security Competencies for Public Sector Roles: A Framework for Enhancing Software Quality and LGPD Compliance - Spósito, Stefano Luppi; Alves, Kassio; Nunes, Rafael Rabelo; Ferreira, Leonardo Rodrigo; Canedo, Edna Dias (Anais do Simpósio Brasileiro de Qualidade de Software (SBQS), 2025)
Context: The increasing complexity of digital public services has heightened the need for robust governance mechanisms in privacy and information security, particularly in light of Brazil’s General Data Protection Law (LGPD). However, public institutions often lack clearly defined roles, responsibilities, and competencies for professionals managing sensitive data and system security. Objective: This study aims to develop a comprehensive competency framework that maps the responsibilities and required knowledge, skills, and abilities (KSAs) for key privacy and information security roles in the Brazilian federal public administration. Method: We employed a design science approach, grounded in national regulations (LGPD, PPSI, IN GSI/PR nº 3/2021) and international standards (e.g., ISO/IEC 27701), to analyze legal and normative documents. The process included the identification of 24 institutional roles (8 in privacy, 16 in information security), the modeling of KSAs across three proficiency levels, and the use of the Analytic Hierarchy Process (AHP) to prioritize competencies. Results: The resulting framework provides structured competency profiles for each role, supporting training journey design, maturity assessment, and decision-making for role allocation. An interactive online platform makes the full model publicly accessible, offering practical tools for public sector adoption. Key findings highlight overlapping areas between privacy and security domains, reinforcing the need for coordinated institutional efforts. Conclusion: By clarifying role expectations and aligning them with legal and technical requirements, the framework supports public organizations in improving their institutional maturity in privacy and security governance. It also contributes to the quality, reliability, and trustworthiness of digital public services through strategic capacity-building.