Supplementary Material for Towards a Taxonomy of Privacy Requirements Based on the LGPD and ISO/IEC 29100

Abstract: Ensuring compliance with data privacy principles imposed by current legislation is a challenge to be faced by software development teams since it requires adapting processes to achieve compliance with laws. This work proposes a taxonomy of privacy requirements based on the Brazilian General Data Protection Law (LGPD) and the ISO/IEC 29100 to support software development teams in achieving compliance with the law. A systematic literature review (SLR) was carried out to identify existing data privacy taxonomies in the literature, which identified 10 primary studies that served as the basis for the creation of our taxonomy. The proposed taxonomy is composed of 129 requirements, divided into 10 categories and 5 contexts. It was applied in the consent request process of the Open Banking Brazil (OPB) project, which shares users' data with their consent. Its application resulted in a satisfactory percentage of adherence to privacy requirements, which demonstrated that it is effective in achieving its goal. Files: privacy_requirements_taxonomy.pdf: List of the 129 requirements grouped by categories and contexts; SLR_bibs.zip: Bib files returned by the search string; TAAF_application.zip: Terms and conditions of the banks from the OPB project and the forms used for applying the taxonomy. ISO_requirements.pdf: List of requirements extracted from ISO/IEC 29100