Framework para conformidade contínua com a LGPD: uma implementação com language server protocol em pipelines DevSecOps

Abstract

The increasing complexity of data protection regulations, such as the Brazilian General Data Protection Law (LGPD), imposes significant challenges on software engineering. Concurrently, while the DevSecOps culture aims for continuous security, it still lacks solutions for automated regulatory compliance. This research aims to develop and validate a framework for the continuous integration of LGPD compliance into DevSecOps pipelines, utilizing the Language Server Protocol (LSP) for static code analysis. To this end, the methodology followed three phases: (1) hybrid extraction of requirements, combining Large Language Models (LLMs) with human curation; (2) development of an LSP server with a modular architecture, implemented in TypeScript; and (3) empirical validation through a Proof of Concept (PoC) applied in two scenarios: real-time detection in the IDE (shift-left security) and as a security gate in a CI/CD pipeline. As for the results, the framework enabled the creation of a validated catalog of 17 Non-Functional Requirements (NFRs) derived from the LGPD, the implementation of 11 static analysis rules, and demonstrated 100% detection of intentional violations in the experimental validation scenarios. The results confirmed all research hypotheses, showing that the proposed approach is both viable and effective. This work contributes a model for operationalizing compliance as code, reducing the dependency on manual processes and empowering developers to build more secure and law-abiding systems from the earliest stages of development.