Uma Abordagem Baseada em LLMs para Auditoria Contínua de Conformidade com a LGPD em Microsserviços Integrada a Pipelines CI/CD
Resumo
Sistemas baseados em microsserviços ampliam os desafios de conformidade com a LGPD, pois a distribuição do tratamento de dados e a alta frequência de mudanças tornam auditorias manuais pouco escaláveis. Além disso, ferramentas tradicionais de análise estática possuem limitações para interpretar requisitos legais de forma semântica. Este trabalho propõe uma arquitetura de auditoria contínua que combina detecção estática e análise semântica baseada em LLMs, apoiada em Retrieval-Augmented Generation (RAG) sobre dispositivos da LGPD e integrada a pipelines CI/CD como GitHub Action. O protótipo LGPD Guard foi avaliado em um estudo exploratório com três repositórios de código aberto, incluindo dois sistemas governamentais brasileiros em produção. Os resultados fornecem evidências preliminares de que a camada LLM+RAG pode complementar o detector estático, ajudando a identificar possíveis violações adicionais e a apoiar a incorporação de privacy by design em pipelines de DevSecOps.Referências
Abualhaija, S., Ceci, M., Sannier, N., Bianculli, D., Lannier, S., Siclari, M., Voordeckers, O., and Tosza, S. (2025). LLM-assisted extraction of regulatory requirements: A case study on the GDPR. In Proceedings of the IEEE International Requirements Engineering Conference (RE). IEEE.
Amaral, O., Abualhaija, S., Torre, D., Sabetzadeh, M., and Briand, L. C. (2022). AI-enabled automation for completeness checking of privacy policies. IEEE Transactions on Software Engineering, 48(11):4647–4674.
Chambers and Partners (2025). Brazil: Data protection & privacy 2025. [link]. Acesso em: fev. 2026.
Chan, C.-M., Chen, W., Su, Y., Yu, J., Xue, W., Zhang, S., Fu, J., and Liu, Z. (2024). ChatEval: Towards better LLM-based evaluators through multi-agent debate. In Proceedings of the International Conference on Learning Representations (ICLR).
Chen, D., Tian, D., Li, H., and Liu, L. (2025). A compliance checking framework based on retrieval-augmented generation. In Proceedings of the International Conference on Computational Linguistics (COLING). ACL Anthology.
Chen, T. (2024). Challenges and opportunities in integrating LLMs into continuous integration/continuous deployment (CI/CD) pipelines. In Proceedings of the 5th International Seminar on Artificial Intelligence, Networking and Information Technology (AINIT), pages 364–367. IEEE.
Dakić, P. (2024). Software compliance in various industries using ci/cd, dynamic microservices, and containers. Open Computer Science, 14.
Donda, D. (2021). Guia Prático de Implementação da LGPD. Editora Labrador, São Paulo.
El Hamdani, R., Mustapha, M., Amariles, D. R., Troussel, A., Meeùs, S., and Krasnashchok, K. (2021). A combined rule-based and machine learning approach for automated GDPR compliance checking. In Proceedings of the Eighteenth International Conference on Artificial Intelligence and Law (ICAIL), pages 40–49. ACM.
Girardi, C., Fernandes, D. Y. d. S., and Rêgo, A. S. d. C. (2025). Unveiling power on combining prompt engineering techniques: An experimental evaluation on code generation. In Proceedings of the 40th Brazilian Symposium on Data Bases (SBBD), pages 357–370, Fortaleza, CE, Brasil. SBC.
Gloaguen, T., Mündler, N., Müller, M., Raychev, V., and Vechev, M. (2026). Evaluating AGENTS.md: Are repository-level context files helpful for coding agents? arXiv preprint arXiv:2602.11988.
Harvard Journal of Law & Technology (2025). Retrieval-augmented generation (RAG): Towards a promising LLM architecture for legal work? Harvard Journal of Law & Technology Digest. Acesso em: fev. 2026.
Johnson, B., Song, Y., Murphy-Hill, E., and Bowdidge, R. (2013). Why don’t software developers use static analysis tools to find bugs? In Proceedings of the 35th IEEE/ACM International Conference on Software Engineering (ICSE), pages 672–681. IEEE.
Lewis, P., Perez, E., Piktus, A., Petroni, F., Karpukhin, V., Goyal, N., Küttler, H., Lewis, M., Yih, W.-t., Rocktäschel, T., Riedel, S., and Kiela, D. (2020). Retrieval-augmented generation for knowledge-intensive NLP tasks. In Advances in Neural Information Processing Systems (NeurIPS), volume 33, pages 9459–9474. Curran Associates.
Li, D. et al. (2024). Enhancing legal compliance and regulation analysis with large language models. arXiv preprint arXiv:2404.17522.
Rodriguez, D., Yang, I., Del Alamo, J. M., and Sadeh, N. (2024). Large language models: A new approach for privacy policy analysis at scale. Computing, 106(12):3879–3903.
Schulhoff, S., Ilie, M., Balepur, N., Kahadze, K., Liu, A., Si, C., Li, Y., et al. (2025). The prompt report: A systematic survey of prompting techniques. arXiv preprint arXiv:2406.06608.
Zheng, L., Chiang, W.-L., Sheng, Y., Zhuang, S., Wu, Z., Zhuang, Y., Lin, Z., Li, Z., Li, D., Xing, E., Zhang, H., Gonzalez, J. E., and Stoica, I. (2023). Judging LLM-as-a-judge with MT-bench and chatbot arena. In Advances in Neural Information Processing Systems (NeurIPS), volume 36. Curran Associates.
Amaral, O., Abualhaija, S., Torre, D., Sabetzadeh, M., and Briand, L. C. (2022). AI-enabled automation for completeness checking of privacy policies. IEEE Transactions on Software Engineering, 48(11):4647–4674.
Chambers and Partners (2025). Brazil: Data protection & privacy 2025. [link]. Acesso em: fev. 2026.
Chan, C.-M., Chen, W., Su, Y., Yu, J., Xue, W., Zhang, S., Fu, J., and Liu, Z. (2024). ChatEval: Towards better LLM-based evaluators through multi-agent debate. In Proceedings of the International Conference on Learning Representations (ICLR).
Chen, D., Tian, D., Li, H., and Liu, L. (2025). A compliance checking framework based on retrieval-augmented generation. In Proceedings of the International Conference on Computational Linguistics (COLING). ACL Anthology.
Chen, T. (2024). Challenges and opportunities in integrating LLMs into continuous integration/continuous deployment (CI/CD) pipelines. In Proceedings of the 5th International Seminar on Artificial Intelligence, Networking and Information Technology (AINIT), pages 364–367. IEEE.
Dakić, P. (2024). Software compliance in various industries using ci/cd, dynamic microservices, and containers. Open Computer Science, 14.
Donda, D. (2021). Guia Prático de Implementação da LGPD. Editora Labrador, São Paulo.
El Hamdani, R., Mustapha, M., Amariles, D. R., Troussel, A., Meeùs, S., and Krasnashchok, K. (2021). A combined rule-based and machine learning approach for automated GDPR compliance checking. In Proceedings of the Eighteenth International Conference on Artificial Intelligence and Law (ICAIL), pages 40–49. ACM.
Girardi, C., Fernandes, D. Y. d. S., and Rêgo, A. S. d. C. (2025). Unveiling power on combining prompt engineering techniques: An experimental evaluation on code generation. In Proceedings of the 40th Brazilian Symposium on Data Bases (SBBD), pages 357–370, Fortaleza, CE, Brasil. SBC.
Gloaguen, T., Mündler, N., Müller, M., Raychev, V., and Vechev, M. (2026). Evaluating AGENTS.md: Are repository-level context files helpful for coding agents? arXiv preprint arXiv:2602.11988.
Harvard Journal of Law & Technology (2025). Retrieval-augmented generation (RAG): Towards a promising LLM architecture for legal work? Harvard Journal of Law & Technology Digest. Acesso em: fev. 2026.
Johnson, B., Song, Y., Murphy-Hill, E., and Bowdidge, R. (2013). Why don’t software developers use static analysis tools to find bugs? In Proceedings of the 35th IEEE/ACM International Conference on Software Engineering (ICSE), pages 672–681. IEEE.
Lewis, P., Perez, E., Piktus, A., Petroni, F., Karpukhin, V., Goyal, N., Küttler, H., Lewis, M., Yih, W.-t., Rocktäschel, T., Riedel, S., and Kiela, D. (2020). Retrieval-augmented generation for knowledge-intensive NLP tasks. In Advances in Neural Information Processing Systems (NeurIPS), volume 33, pages 9459–9474. Curran Associates.
Li, D. et al. (2024). Enhancing legal compliance and regulation analysis with large language models. arXiv preprint arXiv:2404.17522.
Rodriguez, D., Yang, I., Del Alamo, J. M., and Sadeh, N. (2024). Large language models: A new approach for privacy policy analysis at scale. Computing, 106(12):3879–3903.
Schulhoff, S., Ilie, M., Balepur, N., Kahadze, K., Liu, A., Si, C., Li, Y., et al. (2025). The prompt report: A systematic survey of prompting techniques. arXiv preprint arXiv:2406.06608.
Zheng, L., Chiang, W.-L., Sheng, Y., Zhuang, S., Wu, Z., Zhuang, Y., Lin, Z., Li, Z., Li, D., Xing, E., Zhang, H., Gonzalez, J. E., and Stoica, I. (2023). Judging LLM-as-a-judge with MT-bench and chatbot arena. In Advances in Neural Information Processing Systems (NeurIPS), volume 36. Curran Associates.
Publicado
19/07/2026
Como Citar
SILVA, Lucas Matheus; ALBUQUERQUE, Danyllo; DANTAS FILHO, Emanuel; MORENO, Bruno Neiva.
Uma Abordagem Baseada em LLMs para Auditoria Contínua de Conformidade com a LGPD em Microsserviços Integrada a Pipelines CI/CD. In: SEMINÁRIO INTEGRADO DE SOFTWARE E HARDWARE (SEMISH), 53. , 2026, Gramado/RS.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2026
.
p. 758-769.
ISSN 2595-6205.
DOI: https://doi.org/10.5753/semish.2026.21832.
