Investments in Privacy Programs

Julie Silveira Cerqueira; Eliza Remédio Alecrim

DOI: 10.22167/2675-6528-202603083

Article derived from a Course Conclusion Work (TCC), with content based on the student’s original work and adapted to the editorial format of the E&S Magazine with the support of the ResumeAI tool, an artificial intelligence solution developed by Instituto Pecege for textual synthesis and organization.

Summary

The advancement of large-scale personal data processing and the consolidation of regulatory frameworks, such as the General Data Protection Law (LGPD) and the European General Data Protection Regulation (GDPR), have intensified the need for organizational structures focused on data protection. In this context, the study aimed to analyze investments in privacy programs from a risk management perspective, considering their operational, strategic, and regulatory impacts. The research combined a literature review with a case study applied to a large global technology company and the comparative construction of risk matrices, based on the analysis of public information on the implementation of its privacy program. The investments made by the company contributed significantly to reducing the probability of risks related to personal data processing, as well as promoting advances in governance, organizational maturity, and the incorporation of privacy as a cross-cutting element in business activities. Thus, privacy programs, when supported by continuous investments, go beyond the function of regulatory compliance and establish themselves as strategic instruments capable of generating value and strengthening stakeholder trust, even though practical limits persist in the total mitigation of risks inherent to the technological environment.

Keywords: Regulatory compliance; Organizational strategy; Governance; Personal data protection; Risks.

1. Introduction

The accelerated technological development of recent decades has directly contributed to the large-scale processing of personal data (Soler, 2022). The global systemic environment has evolved in such a way that an unprecedented set of data is constantly managed in various forms. This manipulation has exposed the vulnerability of essential rights to the individual, which until then lacked full legal recognition and protection (Mendes, 2014).

In this context, the General Data Protection Law [LGPD], Law 13.709/2018, was created, integrating the right to privacy as a fundamental right. The LGPD was the result of a change in the international scenario, inspired by the European Data Protection Regulation [GDPR], with the objective of ensuring the adequate processing of personal data (Filipe et al, 2019). The GDPR constituted a relevant basis for understanding the regulatory impacts, leading to an increase in the severity of administrative sanctions in the European Union and pressuring organizations to adopt more strategic approaches regarding privacy (Ruohonen, Hjerppe, 2021).

In corporate environments, the term “Privacy Program” refers to a cluster of measures capable of maintaining regulatory compliance and long-term personal data protection best practices, as defined by the National Institute of Industrial Property [INPI]. A well-structured privacy program strengthens governance, contributes to the efficiency of internal processes, increases customer reputational trust and market valuation, in addition to identifying, preventing, and reducing privacy-related risks (Densmore, 2022). The adoption of a “Data Protection Management Program” is linked to legal obligations and the need to establish a systemic environment integrated with information security (Greenaway; Chan, 2013).

However, in Brazil, the implementation of LGPD has undergone distinct market movements. In the early years of the law’s application, many organizations spent considerable amounts to implement privacy programs, but did not perceive immediate returns to maintain a self-sustaining system (Alvarez & Marsal et al., 2021). Although studies such as the Cisco Data Privacy Benchmark Study (2025) show that 96% of participating companies stated that the benefits of these investments outweigh the costs, in the Brazilian context, organizational resistance to resource allocation still persists.

This apparent dissociation between the results indicated by research and the practice adopted by organizations exposes a relevant problem. The absence of dedicated teams and specific privacy tools was associated with a lower prioritization of the topic, even in organizations that recognized its relevance (Matos et al., 2025). Thus, the growing perception of the importance of privacy does not always translate into effective organizational investments.

Given this scenario, it is crucial to verify to what extent investments in privacy programs can be understood not only as a measure of regulatory compliance, but also as instruments capable of generating value for organizations and strengthening the trust of users, partners, and other stakeholders. The objective of this work is to evaluate the investments made in privacy programs by a global technology sector company, from a risk perspective, also considering the regulatory context and market perception, in order to understand their financial, reputational, and strategic impacts.

2. Material and Methods

The present research adopted a qualitative approach, seeking to understand the impacts of investments in privacy programs and describe their relationship with risk mitigation in the organizational context. An interpretive analysis of information pertinent to the implementation of privacy programs and their effects from regulatory, strategic, and operational perspectives was carried out, according to the established objective.

The research method consisted of a case study, applied to a large global company in the technology sector. The company’s selection was intentional, justified by its international operations, high exposure to risks related to the processing of personal data, and the availability of public information about its privacy program.

The temporal scope of the analysis focused on the period after 2019. This period was chosen to consider the restructuring of the organization’s privacy program following relevant regulatory events, allowing for an assessment of the implemented measures in an updated compliance context.

Data collection was carried out through bibliographic and documentary research. It encompassed the analysis of applicable legislations, such as the General Data Protection Law (LGPD) and the European Data Protection Regulation (GDPR), in addition to academic articles and specialized works.

Complementarily, institutional reports and official publications from the studied company were analyzed. These documents provided the necessary information to identify the measures implemented in the privacy program and the risks associated with the processing of personal data.

The data analysis was conducted from a qualitative approach, based on risk management concepts. A 5×5 risk matrix was used, built based on the probability and impact criteria of events associated with the processing of personal data.

The risks were identified from the measures implemented in the company’s privacy program. Subsequently, each risk was classified according to its criticality level, allowing a comparison between the pre- and post-implementation scenarios of the privacy measures.

The risk classification, although estimative in nature, was based on a technical analysis of public information and the organization’s reports. The values assigned to probability and impact reflected a technical interpretation based on the available data.

The probability of occurrence of the risks was classified on a scale of 1 to 5, corresponding to the categories: rare, unlikely, possible, probable, and almost certain. The impact was assessed on the same scale of 1 to 5, ranging from very low, low, medium, high to very high.

The risk level was determined by multiplying the probability and impact values, resulting in values between 1 and 25. These values were organized into risk ranges: low (1-5), medium (6-10), high (11–15), and critical (16–25), following established risk management practices.

The assignment of probability and impact levels was based on criteria linked to the intrinsic structure of the technology sector. The Rare (1) and Unlikely (2) levels corresponded to events of low recurrence or mitigated by robust technical controls and governance.

The Possible level (3) included incidents whose materialization depended on specific organizational, operational, or behavioral failures. The Probable (4) and Almost Certain (5) levels covered risks associated with massive data processing and accelerated technological innovation, with high prevention complexity.

For impact measurement, the Very Low (1) and Low (2) levels corresponded to incidents with predominantly local and limited effects. The Medium (3) level comprised events with moderate reputational impacts or localized demands, requiring corrective measures.

The High (4) and Very High (5) levels represented situations of critical exposure, with the potential for collective damage to holders, severe regulatory repercussions, and relevant financial, reputational, or institutional consequences, including the possibility of setting precedents in the technology sector.

From the identification of the measures applied for the restructuring of the privacy program, it was verified which risk was mitigated and the original risk was analyzed. The methodology allowed the elaboration of a 5×5 qualitative risk matrix for each scenario, pre and post-implementation.

This approach made it possible to establish an initial analysis parameter, which served as a comparative basis for evaluating the effects of the privacy program in mitigating the identified risks. The analysis considered the mitigating effect of the adopted measures, such as policy review and the incorporation of privacy in product design.

3. Results and Discussion

Understanding the term “Privacy Program” in corporate environments is fundamental for analyzing investments and their impacts. As defined by the National Institute of Industrial Property [INPI], a privacy program represents a set of measures aimed at ensuring regulatory compliance and promoting best practices in the long-term processing of personal data. This structure, when adequately adapted to an organization’s reality, not only strengthens governance and optimizes internal processes but also enhances customer reputational trust and market valuation, while identifying, preventing, and reducing privacy-related risks (Densmore, 2022).

In the global scenario, the adoption of data protection management programs is intrinsically linked to legal obligations and the need to establish a systemic environment that integrates information security (Greenaway; Chan, 2013). Research such as that conducted by Cisco in partnership with the Centre for Information Policy Leadership [CIPL] indicated that the implementation of these programs avoids regulatory issues, such as sanctions and fines. In 2024, an increase in lawsuits related to data protection was observed in the European Union, according to a survey by the law firm William Fry LLP, reinforcing the importance of strategic approaches.

Cisco’s research also revealed that 96% of participating companies stated that the benefits of privacy investments outweigh the costs. Furthermore, 25% of participants identified ten or more of the twelve areas in which their organizations achieved “significant” or “very significant” benefits as a result of these investments. More than 78% of all participants identified at least four areas of benefit. This data suggests a progression in the understanding that responsibility and the correct implementation of privacy programs allow companies to explore data strategically, generate competitive advantage, and strengthen the trust of customers, partners, investors, and regulators.

However, the Brazilian context presents particularities. In the first years of application of the General Data Protection Law (LGPD), many organizations made substantial investments in privacy programs, but did not perceive immediate returns that guaranteed the system’s self-sustainability (Alvarez & Marsal et al., 2021). Although awareness of the importance of privacy is growing, this perception does not always translate into effective organizational investments, as pointed out by Matos et al. (2025), who associated the absence of dedicated teams and specific tools with a lower prioritization of the topic in Brazil.

This dissociation between perceived global benefits and local resistance to continuous investments highlights the relevance of case studies that demonstrate the strategic value of privacy programs. The present study sought to fill this gap by analyzing the investments of a global technology company, whose actions were driven by a significant agreement with the Federal Trade Commission [FTC]. This agreement resulted from investigations that identified flaws in the processing of users’ personal data, culminating in the imposition of a billion-dollar fine, which prompted the organization to restructure its privacy program.

From investments in privacy programs made by a global technology company

The agreement with the FTC was a milestone for the analyzed company, driving the incorporation of structuring data protection measures and marking a significant advance in personal data management. The analysis focused on the period after 2019, when the organization invested over 8 billion dollars in the development and consolidation of an updated privacy program. This investment focused on implementing substantial improvements in governance, processes, and technical controls, aligning with the parameters established by regulations such as LGPD and GDPR.

The measures implemented by the company were identified from institutional reports and official publications, and their association with the mitigated risks was based on the interpretation of these actions and their relationship with the processing of personal data. Among the measures adopted, the revision of privacy policies stands out, which aimed to mitigate the lack of transparency in the processing of personal data. The incorporation of privacy in product development sought to reduce data exposure resulting from design flaws. Protections integrated from the beginning in each innovation aimed to decrease vulnerabilities in new functionalities and information security incidents.

Other actions included the creation of specific accounts for teenagers, aiming to prevent the inappropriate processing of minors’ data and non-compliance with regulations. End-to-end default encryption for personal messages and disappearing messages were implemented to prevent unauthorized access to private communications and information leakage. The introduction of a privacy indicator in specific products sought to establish user understanding of their data protection level. The enhancement of the privacy recognition infrastructure and the provision of data logs to data subjects aimed to mitigate failures in monitoring and control, as well as to ensure the fulfillment of data subjects’ rights, especially access to personal information.

The methodology for risk analysis consisted of developing a 5×5 qualitative risk matrix, based on probability and impact criteria. Probability was classified on a scale of 1 to 5, corresponding to the categories rare, unlikely, possible, probable, and almost certain. Impact was also assessed on a scale of 1 to 5, ranging from very low, low, medium, high to very high. The risk level was determined by multiplying probability and impact, resulting in values between 1 and 25, organized into risk bands of low (1-5), medium (6-10), high (11-15), and critical (16-25), according to established risk management practices.

The probability criteria were linked to the intrinsic structure of the technology sector. The Rare (1) and Unlikely (2) levels were assigned to events of low recurrence or significantly mitigated by automated technical controls and robust governance structures. The Possible (3) level encompassed incidents dependent on specific organizational, operational, or behavioral failures. The Likely (4) and Almost Certain (5) levels covered risks associated with the massive processing of personal data and the accelerated pace of technological innovation, whose complete prevention is highly complex.

For impact measurement, criteria were also established on a scale of 1 to 5. The Very Low (1) and Low (2) levels corresponded to incidents with predominantly local and limited effects, without relevant regulatory exposure or potential for significant harm to stakeholders. The Medium (3) level encompassed events capable of generating moderate reputational impacts or localized demands, requiring corrective measures. The High (4) and Very High (5) levels represented situations of critical exposure, with the potential for collective harm, severe regulatory repercussions, and relevant financial or institutional consequences, possibly even setting precedents in the technology sector.

In the pre-implementation scenario of the privacy program, the analysis of inherent risks revealed a predominance of high and critical levels. For example, the lack of transparency in the processing of personal data presented a Probable (4) likelihood and a Medium (3) impact, resulting in a High (12) risk level. Data exposure resulting from privacy failures in the design of products and services was Probable (4) with a High (4) impact, classifying as Critical (16). Vulnerabilities in new functionalities and information security incidents, as well as unauthorized access to private communications, were classified as Critical (20), both with a Probable (4) likelihood and a Very High (5) impact.

Other significant risks in the initial scenario included the inadequate treatment of minor data, classified as High (12) with a Possible (3) probability and High (4) impact. Failures in monitoring, control, and enforcement of privacy policies were also considered High (12), with a Possible (3) probability and High (4) impact. Non-compliance with data subject rights, especially the right to access personal information, was classified as Critical (16), with a Probable (4) probability and High (4) impact. This classification logic considered the recurrence of incidents in the technology sector and the technical complexity of prevention.

After the implementation of the privacy program measures, the analysis of residual risks demonstrated a significant mitigation potential. The lack of transparency in the processing of personal data, which was previously High (12), was reclassified to Medium (6), with an Unlikely (2) probability and Medium (3) impact. Data exposure resulting from privacy failures in the design of products and services, previously Critical (16), was reduced to Medium (8), with an Unlikely (2) probability and High (4) impact. The inadequate processing of data of minors was also reduced from High (12) to Medium (8), with an Unlikely (2) probability and High (4) impact.

The reclassification of risks was consistent across several categories. Unauthorized access to private communications and information leakage, which was Critical (20), was reduced to Medium (10), with an Unlikely (2) probability and a Very High (5) impact. Failures in monitoring, control, and enforcement of privacy policies, previously High (12), became Medium (8), with an Unlikely (2) probability and a High (4) impact. Non-compliance with data subject rights, which was Critical (16), was mitigated to Medium (8), with an Unlikely (2) probability and a High (4) impact. These results indicate a process of organizational maturation in the incorporation of privacy.

The observed mitigation in risk levels was not solely due to the formal adoption of policies, but was a direct result of continuous investments in governance, processes, and technology. The structuring of dedicated privacy teams, the enhancement of internal governance flows, the incorporation of technical controls in products, and the constant review of organizational practices demonstrated that the measurable reduction of risks is intrinsically linked to financial and strategic contributions. The effectiveness of the privacy program analyzed, therefore, cannot be dissociated from the volume of resources invested in its consolidation and maintenance.

Despite the general reduction, some risks remained at a higher level in the residual scenario, evidencing the practical limits of a privacy program, even with significant investments. The risk related to vulnerabilities in new functionalities and information security incidents remained at a High level (15), with a Possible probability (3) and a Very High impact (5). This risk is directly associated with the dynamics of technological innovation, where the constant creation and updating of functionalities increases exposure to technical failures, making complete elimination an inherent challenge in the sector.

Similarly, the risk of unauthorized access to private communications, although significantly reduced from Critical (20) to Medium (10), cannot be entirely eliminated. This is due to the accelerated sophistication of malicious actors and persistent external threats, even with advanced encryption and technical controls. These examples demonstrate that certain risks do not stem from failures of the privacy program itself, but from inherent limitations within the complex technological context in which the organization operates, reinforcing the need for permanent maintenance of privacy governance.

In summary, the analysis of inherent and residual risk matrices revealed that investments in privacy programs, especially when robust and continuous, are capable of promoting a significant reduction in the criticality levels of risks associated with personal data processing. The reclassification of critical risks to moderate levels, as well as the general decrease in the probability of occurrence, demonstrates that these programs transcend the function of mere regulatory compliance, establishing themselves as strategic instruments that generate value and strengthen stakeholder trust, despite the practical limits in the total mitigation of risks intrinsic to the dynamic technological environment.

4. Conclusion

This study evaluated the investments made in privacy programs by a global technology sector company, from a risk management perspective, seeking to understand their operational, strategic, and regulatory impacts. It was found that significant investments in governance, processes, and technology contributed to a significant reduction in the probability of risks related to the processing of personal data occurring. The comparative analysis of risk matrices showed that risks previously classified as critical were reclassified to moderate levels, indicating substantial progress in organizational maturity and the incorporation of privacy as a cross-cutting element in business activities. This risk mitigation demonstrated that privacy programs transcend the function of mere regulatory compliance, establishing themselves as strategic instruments capable of generating value and strengthening stakeholder trust.

However, it was observed that the privacy program, even with significant financial contributions, encounters practical limits in the complete elimination of risks inherent to the dynamics of technological innovation. Risks such as vulnerabilities in new functionalities and information security incidents, as well as unauthorized access to private communications, remained at higher levels, reflecting intrinsic challenges in the technological environment and the sophistication of external threats. Such findings reinforce the need for continuous maintenance of privacy governance efforts. It is suggested that future research delve deeper into the analysis from other risk perspectives and methodological approaches, in order to broaden the understanding of the impacts of privacy investments in organizations.

Bibliographic References

ALVAREZ & MARSAL; HLF MAP; PRIVACY TOOLS; SERUR ADVOGADOS; ASSOCIAÇÃO BRASILEIRA DE NORMAS TÉCNICAS (ABNT). Pesquisa sobre a LGPD no mercado brasileiro. São Paulo: Alvarez & Marsal, 2021. Disponível em: https://www.alvarezandmarsal.com/pt-br/insights/pesquisa-lgpd-no-mercado-brasileiro Acesso em: 18 jan. 2026

CISCO. 2025 Data Privacy Benchmark Study. Cisco, 2025. Disponível em: https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/cisco-privacy-benchmark-study-2025.pdf . Acesso em: 10 out. 2025.

DENSMORE, Russell (org.). Gestão do programa de privacidade: ferramentas para gerenciar a privacidade na sua organização. São Paulo: International Association of Privacy Professionals, 2022. Acesso em: 20 jan. 2026

FILIPEC, Ondřej; PAIVA ALVES, Malu; NOCHANG HECK, Leonardo; DELVAUX PARMA, Gustavo. Personal data protection in Brazil: how much Europeanization? International and Comparative Law Review, v. 22, n. 2, p. 81–104, 2022. DOI: 10.2478/iclr-2022-0016. Acesso em: 11 jan. 2026.

GREENAWAY, K. E.; CHAN, Y. E. Designing a Customer Information Privacy Program Aligned with Organizational Priorities. MIS Quarterly Executive. 12, n. 3, p. 137–150, 2013. Disponível em: https://research.ebsco.com/linkprocessor/plink?id=f5d7acb4-b1a6-3380-81f1-c6274deec441. Acesso em: 20 jan. 2026.

MATOS, Aryely et al

MENDES, Laura S. Série IDP – Linha de pesquisa acadêmica – Privacidade, proteção de dados e defesa do consumidor : linhas gerais de um novo direito fundamental, 1ª Edição.. Rio de Janeiro: Saraiva, 2014. E-book. p.79. ISBN 9788502218987. Disponível em: https://app.minhabiblioteca.com.br/reader/books/9788502218987/. Acesso em: 15 jan. 2026.

RUOHONEN, Jukka; HJERPPE, Kalle. The GDPR enforcement fines at a glance. Information Systems, v. 106, p. 101876, 2022. Disponível em: https://doi.org/10.1016/j.is.2021.101876 . Acesso em: 17 jan. 2026.

Soler, Fernanda G. Proteção de dados: reflexões práticas e rápidas sobre a LGPD. Rio de Janeiro: Expressa, 2022. E-book. p.9. ISBN 9786553622500. Disponível em: https://app.minhabiblioteca.com.br/reader/books/9786553622500/ Acesso em: 08 out. 2025

Article originating from the Final Course Work of the Specialization in Compliance and ESG of the MBA USP/Esalq

To learn more about the course, click here and access the MBX Academy platform