Brazil LGPD Incident Reporting to ANPD

Report only when all three conditions are met: the event is a confirmed adverse event that compromises the confidentiality, integrity, availability, or authenticity of personal-data security; it involves personal data subject to the LGPD; and it may cause relevant risk or damage. A vulnerability without a confirmed adverse event is not an incident, and an event limited to effectively anonymised data is not reportable to the ANPD under this rule.

Relevant risk or damage requires the potential to affect data subjects' fundamental interests and rights significantly and at least one listed factor: sensitive data; data about children, adolescents, or older people; financial data; system-authentication data; data protected by legal, judicial, or professional secrecy; or large-scale processing. Assess the context, people, nature and amount of data, possible material, moral, or reputational harm, protection against identification, and post-incident mitigation. The controller decides and files; an operator must notify the controller without unjustified delay and provide the facts needed for both notices.

File with the ANPD and notify affected data subjects within three business days from the controller's knowledge that the incident affected personal data, unless specific legislation sets another period. Qualifying small processing agents receive double time under Resolution 2/2022 as amended by Resolution 15/2024.

The ANPD filing should identify the incident, affected data and people, controller and operator, occurrence and knowledge dates, risks, technical and security measures, mitigation, communications, delay reasons, and contact route. The affected-person notice should state the nature and categories of affected data, technical and security measures subject to protected secrets, risks, the controller's knowledge date, delay reasons where applicable, mitigation or reversal measures, recommended protective action, and a contact route. Do not send the ANPD a list of affected people or their contact details merely to prove notice.

A controller that lacks complete information may make a justified preliminary ANPD communication and provide the missing information within 20 business days from that communication, or 40 business days for qualifying small processing agents under Article 6(8). The supplement must be filed in the same process. A preliminary filing is not a completed Article 48 communication.

Notify data subjects directly and individually where possible, using simple language and a familiar channel. Indirect public communication is exceptional and requires justification. If the affected individuals cannot yet be distinguished, the controller may need to notify everyone whose personal data was in the affected dataset.

Keep a record of every security incident involving personal data, including incidents that were not communicated, for at least five years from registration unless another duty requires longer retention. Article 10(2) provides an exception for Article 23 public bodies that follow applicable permanent-record archival rules. The file should reproduce the chronology, scope, risk assessment, reportability decision, communications, mitigation, and later corrections.

Close the reporting work only after required supplements are filed, data-subject notice is complete, delivery evidence is retained, ANPD follow-up is assigned, and the final facts are reflected in remediation, processing records, contracts, and relevant RIPDs.