MITIGATION OF CYBER RISKS IN THE BRAZILIAN BANKING SYSTEM: DATA GOVERNANCE, LGPD AND OPERATIONAL RESILIENCE

Abstract

This article analyzes the mitigation of cyber risks in the Brazilian banking system, focusing on the relationship between data governance, the normative requirements of the General Data Protection Law (LGPD — Law No. 13,709/2018), and the operational resilience requirements imposed by the Central Bank of Brazil, particularly through Resolution CMN No. 4,893/2021. The study investigates how the regulatory convergence between data protection and cybersecurity structures legal and technical obligations for financial institutions, identifying the main compliance gaps and the instruments available to address them. The methodological procedure adopted is qualitative bibliographic and documentary research, with a critical analysis of legislation, sectoral regulations, specialized literature, and reports from national and international bodies. The results show that the Brazilian regulatory framework, while innovative, still presents weaknesses in sanction effectiveness, institutional coordination between the National Data Protection Authority (ANPD) and the Central Bank of Brazil (BCB), and in the technical training of cybersecurity teams in financial institutions. Furthermore, it is found that operational resilience requires not only technological investment but also the construction of an organizational compliance culture, with data governance integrated into risk management. The study contributes to the academic and institutional debate on the adequacy of the Brazilian legal framework to the demands of the digital economy and to the improvement of public policies on cybersecurity in the banking sector.