Information security and data privacy are considered areas that present great challenges for the information society due to the technological advance of Artificial Intelligence, Big Data and Internet of Things that make use of the large volume and variety of data generated by information systems, and the use of current computational power can transform data into information and intelligence for making decisions. This process can violate the users' privacy and their fundamental rights. In order to regulate how public or private companies will manage user data in their environment, Brazilian government has sanctioned the Law 13.709/2018, known as the General Data Protection Law (LGPD). This article identify the application of the law to educational institutions, in particular to the Federal Institute assessment compliance within the law. In the evaluation carried out, it was identified that the Federal Institute is in the initial stage of complying with the law, which is critical due the volume of work that consists of adapting the institution's processes and systems, as well as changing the institutional culture of management of personal data. Increasing the criticality, there’s a short time to complying with the law, as it goes into effect in Mai 2021.