Build the incident workflow around Article 48 and the current ANPD reporting rule.
If the incident can create relevant risk or damage, the timing, content, and evidence trail now matter as much as the technical response.
Structured answer sets in this page tree.
Cited legal and guidance references.
Article 48 requires the controller to notify ANPD and the affected data subjects when a security incident can create relevant risk or damage. The current ANPD incident communication flow uses a 3 business day deadline, allows preliminary communication when facts are still being established, and requires complement information within 20 business days.
Not every security event is reportable. The threshold is an incident involving personal data that can create relevant risk or damage to data subjects.
Your first decision record should therefore document the affected data, the likely consequences, whether confidentiality, integrity, or availability was compromised, and who approved the risk conclusion.
Assessment Autopilot can take Brazil LGPD Incident Reporting from operationalizing response workflows and review cycles to a reusable workflow inside Sorena. Teams working on Brazil LGPD can keep owners, evidence, and next steps aligned without copying this guide into separate documents.
Start from Brazil LGPD Incident Reporting and turn the guidance into owned tasks, evidence requests, and review checkpoints.
Review your current process, evidence gaps, and next steps for Brazil LGPD Incident Reporting.
The ANPD incident form and the transfer regulation annexes both reflect the current 3 business day communication rule under Resolution CD ANPD No. 15 of 24 April 2024. Teams need one record that shows when the incident occurred, when the controller learned of it, when ANPD was notified, and when data subjects were notified.
Operator notice to the controller is a critical upstream dependency. If the operator is late or incomplete, preserve that evidence because it affects the controller timeline and vendor oversight record.
The ANPD form supports a preliminary communication when all facts are not yet available or data subject communication has not yet occurred. That is a controlled exception, not a substitute for closing the investigation later.
A preliminary communication must be followed by a complement submission in 20 business days, in the same process, with the missing facts and the final risk assessment.
The current ANPD form expects controller identity, DPO or representative information, operator data when relevant, risk evaluation, incident type, affected categories of data and data subjects, likely consequences, and mitigation actions.
Data subject communications should use clear language and explain what happened, what data was affected, the risks, the mitigation measures, and how to contact the controller for more information.