ABSTRACT Recent studies have shown that many software developers do not have sufficient knowledge and understanding of how to develop a privacy‐friendly system. This may become a challenge in developing systems complying with data protection laws. To address this issue, we investigated the factors that influence developers' decision‐making when developing privacy‐sensitive systems. We conducted an empirical study by means of a survey with 109 practitioners. Our data analysis is based on the principles of social cognitive theory, which includes personal, behavioral, and external environmental factors. We identified six personal, five behavioral, and five external environment factors that affect how developers make decisions regarding privacy, including confusion between privacy and security and reliance on informal practices and organizational support gaps. These findings contribute to understanding how practitioners and companies consider privacy, showing improvements in formal training and structured support over previous studies yet highlighting persistent challenges in consistent privacy integration.

Privacy has become a concern in Agile Software Development (ASD), either to satisfy users' needs or to comply with privacy laws. However, recent studies have shown that ASD approaches still neglect non-functional requirements (NFRs), as is the privacy case. This concern and new data protection laws that came into force recently led companies to face the challenges to understand the laws and to comply with them. In addition, research has shown that many developers do not have sufficient knowledge about how to develop privacy-sensitive software. Motivated by this scenario, this tutorial aims to draw attention to the need to understand privacy from the beginning of the software development lifecycle. Initially, we will present an overview of privacy, as well as several privacy principles. Later, we will show the main data protection laws (In-depth detailing of the General Data Protection Regulation - GDPR). Then, we will discuss how to read and evaluate privacy policies. Finally, we will present an approach for specifying privacy requirements in ASD called Privacy Criteria Method (PCM). At the end of the tutorial, participants will be able to have a critical and technical view of privacy when performing the requirements specification activity.