Brazil LGPD Incident Reporting To ANPD

LGPD Article 48 creates the binding notification duty, and ANPD Resolution 15/2024 defines the current threshold, content, procedure, and deadlines. A vulnerability without a confirmed event, an incident that does not involve personal data subject to the LGPD, or an incident that cannot cause relevant risk or harm does not meet all three reporting criteria. Keep the assessment even when the outcome is non-reportable.

Assess the nature and sensitivity of the data, the processing context, the number and vulnerability of affected people, possible material or moral effects, and safeguards already effective at the time of the event. For example, the theft of strongly encrypted data may present a different risk from theft of the same readable data, but encryption is evidence to assess rather than an automatic exemption.

Qualifying small processing agents have six business days for each notice under Articles 6(8) and 9(6). The ordinary three-business-day period starts when the controller learns that the incident affected personal data, not when the investigation closes or the threshold assessment is complete. The duty to notify still applies only if the incident may cause relevant risk or harm. Record the occurrence, detection, operator notice, controller knowledge, facts available for the threshold decision, and any shorter or different sector-specific deadline.

The controller owns the reportability decision and both required communications. The operator should alert the controller without unjustified delay and provide logs, affected systems and data, containment actions, and other facts required by contract or instruction. The encarregado or a legal representative may submit the ANPD filing, but that does not transfer the controller's accountability.

Keep a decision record for every confirmed incident, including those assessed as non-reportable. It should connect the chronology and technical evidence to each reporting criterion and show who made the controller decision. Resolution 15/2024 requires the controller to keep the incident record for at least five years from the record date, unless another rule requires longer retention; Article 10(2) exempts Article 23 public entities from those retention periods if they follow the applicable permanent-record rules in their own retention schedule or those defined by the National Archives Council.

Do not rely on the LGPD's general 'reasonable time' wording without applying Resolution 15/2024. A preliminary communication is not complete compliance: investigate, mitigate, notify affected people, and supply the justified missing information within the complementary period. ANPD may require corrections, broader disclosure, additional mitigation, or other measures after reviewing the case.