Ethical data governance for sensitive document classification under the LGPD
TL;DR
The findings indicate the feasibility of the BERT model as an initial, human-in-the-loop screening stage for ethical data governance in the public sector.
Abstract
This study investigates the use of the BERT model to support the automated classification of public documents according to whether they contain personal or sensitive data, in compliance with the Brazilian General Data Protection Law (LGPD). Documents from the Mato Grosso State Official Press (IOMAT) were used, comprising 1,050 documents labelled as sensitive and 450 labelled as non-sensitive. In this version, only a document-level binary classifier (sensitive vs. non-sensitive) was implemented and evaluated; Named Entity Recognition (NER), Explainable AI (XAI), and an auditing interface are described as part of a broader system planned as future work. The model — a fine-tuned BERTimbau classifier — was trained after removing explicit date expressions from the texts, with a fixed seed and deterministic settings for reproducibility. On the validation set, it reached 75.00% accuracy and an 83.66% positive-class F1-score, with a macroF1 of 65.23%. Compared with a majority-class baseline, the main improvement was observed in macro-F1, indicating that the model learned useful patterns beyond simply assigning all documents to the sensitive class. An error analysis based on the confusion matrix shows that false negatives are the legally costlier errors in a compliance setting, as they may correspond to sensitive documents being treated as non-sensitive. The results should be interpreted as preliminary and corpus-dependent, since date removal reduces but does not eliminate temporal and topical composition effects. Even so, the findings indicate the feasibility of the approach as an initial, human-in-the-loop screening stage for ethical data governance in the public sector.
