MMAI-LGPD: A Maturity Model for Governance and Data Compliance in Information Systems Institutions

Context: The General Data Protection Law (LGPD) in Brazil demands organizations implement governance, compliance, and data security frameworks. This requirement is particularly significant for institutions managing Information Systems (IS), which face challenges in aligning technological innovation with regulatory demands. The MMAI-LGPD addresses this gap by integrating legal, organizational, and technological dimensions into a structured compliance framework tailored for IS institutions. Problem: Despite the urgency of LGPD compliance, there is no widely adopted maturity model specifically designed for IS institutions, leaving organizations struggling to balance governance, security, and operational efficiency while meeting legal and ethical requirements. Solution: This paper presents the MMAI-LGPD, a model that categorizes compliance into five maturity levels and defines 57 items across six dimensions, offering a pathway for improving governance, security, and data management practices. IS Theory: The research adopts a sociotechnical approach, building on maturity models in Information Systems to integrate governance, technology, and legal perspectives. Method: A qualitative, prescriptive approach was used, including content analysis of LGPD requirements and case studies with six IS institutions. Axial coding validated the model's applicability and identified organizational gaps in compliance practices. Results: The MMAI-LGPD provides a practical tool for assessing and improving compliance maturity. Validation results demonstrate its effectiveness in aligning governance, technology, and legal frameworks in IS institutions. Contributions and Impact on IS: This research bridges academia and practice, advancing maturity model studies in IS. The MMAI-LGPD enables IS institutions to meet regulatory demands while fostering ethical and sustainable practices in digital ecosystems.