Privacy by Design Maturity in Software Development: An Empirical Study in Brazilian Federal Higher Education Institutions

Context: Privacy by Design (PbD) has emerged as a key approach to embedding data protection into software systems from their inception, a pressing concern in Brazil after the enactment of the General Data Protection Law (LGPD). However, public organizations such as Brazilian Federal Higher Education Institutions (IFES) still struggle to translate legal requirements into concrete engineering practices and governance routines. Goal: This study investigates how IT professionals in IFES perceive, adopt, and operationalize PbD in software development, and which organizational, technical, and individual factors influence the maturity of privacy practices in this context. Method: We conducted a mixed-method survey with 58 IT professionals from IFES across 15 Brazilian states. The instrument combined 46 closed-ended and 9 open-ended questions covering privacy knowledge, attitudes, behaviors, strategies, and organizational conditions. Results: Respondents strongly recognize privacy as a fundamental right and a shared responsibility and frequently handle personal and sensitive data in their daily work. Core strategies such as encryption, data minimization, anonymization, risk management, and user control are perceived as very important and are more often applied, whereas decentralization, data sovereignty, and temporality remain rare and harder to implement. Nonetheless, formal training and solid regulatory knowledge are limited, dedicated privacy teams and tools are exceptions, and privacy is often treated as a moderate or low organizational priority. Conclusion: PbD maturity in IFES remains incipient: practices are fragmented, reactive, and dependent on individual initiative rather than institutional structures. Advancing this maturity requires structured training, clearer roles and responsibilities, better tool support, and a proactive privacy culture. The study provides an empirical baseline for PbD adoption in Brazilian higher education and offers evidence to guide capacity building and governance initiatives aligned with the LGPD.