Brazil LGPD Breach Notification

Resolution 15/2024 defines an incident as a confirmed adverse event that violates confidentiality, integrity, availability, or authenticity of personal-data security. A vulnerability without a confirmed adverse event is not by itself a reportable incident, and an event involving only data that is not personal data does not meet the LGPD gate.

Relevant risk or damage requires a potential significant effect on fundamental interests and rights and, cumulatively, at least one listed factor: sensitive data; data about children, adolescents, or older people; financial data; system-authentication data; data protected by legal, judicial, or professional secrecy; or large-scale data.

The controller owns the Article 48 decision and communication. Security investigates and contains the event; operators notify the controller and provide available information without delay; privacy or legal applies the reportability test; communications and support teams prepare clear, direct instructions for affected people.

Notify the ANPD and affected people within three business days, unless a shorter period applies. If justified information is unavailable, make a preliminary ANPD communication and provide the complement within 20 business days from the preliminary filing. A preliminary filing does not complete Article 48 by itself.

The ANPD filing should identify the incident, affected data and people, controller and operator, occurrence and knowledge dates, risks, technical and security measures, mitigation, data-subject communication, any delay, and the controller's contact route. The notice to affected people should explain the nature and categories of affected data, protection measures subject to protected secrets, risks, the controller's knowledge date, mitigation or reversal measures, recommended steps, delay where relevant, and a contact for questions.

Encryption, pseudonymisation, containment, or deletion by the recipient can reduce risk but does not automatically end the assessment. Consider whether the measures genuinely prevent identification or harmful use, the type and volume of data, vulnerable groups, likely consequences, and whether mitigation reached every affected copy.

A single event can involve several controllers. Each controller must assess its own Article 48 duty. An operator should not file as if it were the controller unless it is legally representing the controller through the accepted procedure.

Maintain a tested incident intake, controller knowledge timestamp, operator escalation clause, reportability worksheet, ANPD filing owner, affected-person notice path, 20-business-day complement tracker, five-year record, and remediation owner.

The output should be either a reasoned no-report decision or a matched ANPD and affected-person communication package. Update it if later facts change the risk assessment, population, data, or mitigation.