Privacy by Design Maturity in Software Development: An Empirical Study in Brazilian Federal Higher Education Institutions - de Oliveira, Fernando Elias; Spósito, Stefano Luppi; Mendes, Fabiana Freitas; Canedo, Edna Dias (Journal of Software Engineering Research and Development, 2026)
Context: Privacy by Design (PbD) has emerged as a key approach for embedding data protection into software systems from their inception, a pressing concern in Brazil after the enactment of the General Data Protection Law (LGPD). However, public organizations such as Brazilian Federal Higher Education Institutions (IFES) still struggle to translate legal requirements into concrete engineering practices and governance routines. Goal: This study investigates how IT professionals in IFES perceive, adopt, and operationalize PbD in software development, and which organizational, technical, and individual factors influence the maturity of privacy practices in this context. Method: We conducted a mixed-method survey with 58 IT professionals from IFES across 15 Brazilian states. The instrument combined 46 closed-ended and 9 open-ended questions covering privacy knowledge, attitudes, behaviors, strategies, and organizational conditions. Results: Respondents strongly recognize privacy as a fundamental right and frequently handle personal and sensitive data in their daily work. Core strategies such as encryption, data minimization, anonymization, risk management, and user control are perceived as very important and are more often applied, whereas decentralization, data sovereignty, and temporality remain uncommon and are more difficult to implement. Inferential analysis using Spearman’s rank correlation indicates that the adoption of privacy strategies is significantly associated with perceived importance (ρ = 0.37, p = 0.005), while organizational, social, and usability-related factors show no statistically significant associations. Conclusion: PbD maturity in IFES remains incipient, characterized by fragmented and reactive practices driven more by individual perceptions than by institutional structures. Advancing this maturity requires structured training, clearer roles and responsibilities, better tool support, and strategies that reinforce the perceived importance of privacy among practitioners.