The controller must notify the ANPD and affected people when a confirmed incident involving LGPD-covered personal data may cause .
Resolution 15/2024 generally sets a three-business-day clock from the controller's knowledge that personal data was affected, subject to specific legislation and the qualifying small-agent extension.
Use three gates under Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD): confirm that a occurred, confirm that it involves personal data subject to the LGPD, and assess whether it may cause . If all three are met, the controller must notify the Agência Nacional de Proteção de Dados (ANPD) and affected people. Start the clock when the controller knows that the incident affected personal data; an operator must inform the controller without unjustified delay and provide the information needed for the notices.
Resolution 15/2024 defines an incident as a confirmed adverse event that violates confidentiality, integrity, availability, or authenticity of personal-data security. A vulnerability without a confirmed adverse event is not by itself a reportable incident, and an event involving only data that is not personal data does not meet the LGPD gate.
requires a potential significant effect on fundamental interests and rights and, cumulatively, at least one listed factor: sensitive data; data about children, adolescents, or older people; financial data; system-authentication data; data protected by legal, judicial, or professional secrecy; or large-scale data.
Sources (2)
Article 48 is the binding duty to notify the authority and data subjects when an incident may cause relevant risk or damage and lists minimum notice content.
Official explanation of the confirmed-incident, LGPD-data, and relevant-risk gates; risk factors; filing route; timing; phased communication; and records.
The controller owns the Article 48 decision and communication. Security investigates and contains the event; operators notify the controller and provide available information without delay; privacy or legal applies the reportability test; communications and support teams prepare clear, direct instructions for affected people.
Notify the ANPD and affected people within three business days from the controller's knowledge that personal data was affected, unless specific legislation sets another period. Qualifying small processing agents receive six business days under the differentiated regime. If justified information is unavailable, make a and provide the complement within 20 business days from the preliminary filing, or 40 business days for qualifying small processing agents. A preliminary filing does not complete Article 48 by itself.
The ANPD filing should identify the incident, affected data and people, controller and operator, occurrence and knowledge dates, risks, technical and security measures, mitigation, data-subject communication, any delay, and the controller's contact route. The notice to affected people should explain the nature and categories of affected data, protection measures subject to protected secrets, risks, the controller's knowledge date, mitigation or reversal measures, recommended steps, delay where relevant, and a contact for questions.
Sources (1)
Official ANPD timing, filing, preliminary and complementary communication, data-subject notice, and incident-record guidance.
Encryption, pseudonymisation, containment, or deletion by the recipient can reduce risk but does not automatically end the assessment. Consider whether the measures genuinely prevent identification or harmful use, the type and volume of data, vulnerable groups, likely consequences, and whether mitigation reached every affected copy.
A single event can involve several controllers. Each controller must assess its own Article 48 duty. An operator should not file as if it were the controller unless it is legally representing the controller through the accepted procedure.
Sources (2)
Primary LGPD source for Article 48 breach-notification duties to the ANPD and affected data subjects when relevant risk or damage may occur.
O controlador deverá comunicar à autoridade nacional e ao titular a ocorrência de incidente de segurança
Official explanation of risk assessment, controller responsibility, timing, content, and phased communication.
Maintain a tested incident intake, controller knowledge timestamp, operator escalation clause, reportability worksheet, ANPD filing owner, affected-person notice path, complement tracker with the applicable 20- or 40-business-day deadline, five-year record, and remediation owner.
The output should be either a reasoned no-report decision or a matched ANPD and affected-person communication package. Update it if later facts change the risk assessment, population, data, or mitigation.
Sources (1)
Primary LGPD source for Article 48 breach-notification duties to the ANPD and affected data subjects when relevant risk or damage may occur.
O controlador deverá comunicar à autoridade nacional e ao titular a ocorrência de incidente de segurança
Assign the incident assessment, notice, evidence, follow-up, and remediation work.
Turn Breach Notification into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review the incident assessment, notice deadlines, evidence, and remediation owners.
"O controlador deverá comunicar à autoridade nacional e ao titular a ocorrência de incidente de segurança"
How ANPD investigates LGPD infringements, classifies severity, selects sanctions, calculates fines, and weighs aggravating and mitigating evidence.
Apply LGPD Articles 3 and 4 to a processing activity, including foreign organisations, Brazil collection, targeting, exclusions, and the evidence to retain.
An evidence-based Brazil LGPD checklist for scope, roles, legal bases, notices, rights, vendors, security incidents, transfers, retention, and governance.
Build an LGPD compliance program from processing records, legal bases, transparency, rights, security, vendors, transfers, incidents, and accountable evidence.
Classify LGPD controller, operator, sub-operator, and encarregado roles from actual decisions, instructions, processing facts, and Resolution 18 duties.
Brazil LGPD rights guide covering confirmation, access, correction, restriction, deletion, portability, consent, sharing, objection, and automated decisions.
Track Brazil LGPD commencement dates, data-access responses, incident notices, international-transfer clauses, and ANPD fine-payment deadlines.
Build an LGPD data-subject response that identifies the right, applies the correct timing, records the decision, protects third parties, and proves delivery.
Run an LGPD data-subject request from intake and identity checks through rights analysis, response timing, evidence, exceptions, and escalation.
Decide whether an LGPD incident is reportable, calculate the ANPD deadline, prepare complete or staged notices, and keep the required five-year record.
Run an LGPD personal-data incident from confirmation and risk assessment through three-business-day notices, supplementation, mitigation, and records.
Compare LGPD international-transfer mechanisms: adequacy, ANPD standard clauses, approved specific clauses, global corporate rules, consent, and other Article 33 routes.
Brazil LGPD international-transfer guide for identifying transfers, selecting Article 33 mechanisms, applying ANPD clauses, EU adequacy, and transparency.
Compare LGPD Article 7 bases for ordinary personal data and Article 11 bases for sensitive data, with consent, necessity, evidence, and edge cases.
Apply LGPD legitimate interest through purpose, necessity, balancing, reasonable expectations, safeguards, children, sensitive-data limits, and records.
Understand every ANPD administrative sanction under LGPD Article 52, the fine ceilings, non-monetary penalties, and public-body limits.
Answers to common Brazil LGPD questions about scope, roles, legal bases, rights, incidents, transfers, impact reports, small agents, and enforcement.
Reference guide to Brazil LGPD scope, principles, legal bases, transparency, rights, roles, security, incidents, transfers, records, and ANPD oversight.
Build an LGPD RIPD evidence file that proves the processing scope, high-risk screen, necessity, safeguards, residual risk, approval, and later review.
Decide when to prepare an LGPD RIPD, apply the ANPD high-risk screen, document required evidence and mitigation, approve residual risk, and review changes.
Check whether an organization qualifies for Brazil's small-processing-agent regime, which flexibilities apply, and which LGPD duties remain unchanged.
Choose and maintain LGPD templates for processing records, data-subject requests, incidents, RIPDs, transfers, and controller-operator role evidence.
Classify an LGPD international transfer, confirm the processing legal basis and transfer mechanism, document onward transfers, and approve the evidence before launch.
Compare Brazil's LGPD and California's CCPA by scope, legal bases, consumer rights, sale and sharing rules, deadlines, transfers, and enforcement.
Compare Brazil's LGPD and the EU GDPR by scope, legal bases, roles, rights deadlines, impact assessments, incidents, transfers, and enforcement.
Apply LGPD Article 14 to children's and adolescents' data: age categories, best interests, legal bases, parental consent, limited collection, notices, and evidence.
Compare actual decision rights with contracts, operator instructions, sub-operator approvals, and the encarregado channel.
Test tracker classification, legal bases, banner choices, stored preferences, and deployed network behavior.
Assign the reportability decision, knowledge timestamp, ANPD filing, affected-person notice, and follow-up evidence.
Match each exporter, importer, onward flow, and processing basis to the selected Article 33 mechanism.
Record each purpose, data category, statutory basis, necessity, notice, retention, and reassessment trigger.
Document the interest, necessity, alternatives, expectations, impacts, effective safeguards, and approval.
Assign the report trigger, processing description, risk assessment, safeguards, controller decision, and mitigation checks.
Organize the infringement facts, classification, revenue inputs, mitigation evidence, and procedural deadlines.
Verify eligibility, group revenue, the two-part high-risk screen, each flexibility used, and continuing duties.