Brazil LGPD Incident Workflow

Open the privacy incident workflow when an event may have affected the confidentiality, integrity, availability, or authenticity of personal data. A vulnerability with no confirmed adverse event is not itself an incident, and an event involving only effectively anonymized data does not require an LGPD incident notice. Preserve logs and evidence while security contains the event.

The notification test has three cumulative parts: the incident is confirmed, it involves personal data subject to the LGPD, and it may cause relevant risk or damage to data subjects. Assess the processing context, categories and number of people, nature and amount of data, possible material, moral, or reputational harm, effective protection such as encryption, mitigation already completed, large-scale effects, sensitive data, and vulnerable groups.

Treat compromise of authentication credentials, financial or payment data, protected secrets, sensitive data, or data about children and other vulnerable people as a strong risk indicator, especially at scale or where fraud, identity theft, discrimination, physical harm, or denial of a service is plausible. The category alone does not replace the case-specific threshold assessment; record how exposure, protection, duration, recoverability, and completed mitigation change the likely harm.

The controller owns the reportability decision and notifications. An operator must inform the controller without unjustified delay and supply the information needed for the assessment and notices. Contractual escalation periods should be short enough for the controller to meet the legal clock.

Notify the ANPD and affected data subjects within three business days from the controller's knowledge that the incident affected personal data, unless specific legislation sets another period. Resolution 2/2022 gives qualifying small processing agents double time under the incident regulation. A team should confirm that status before relying on the extension.

If complete information is unavailable, submit a justified preliminary ANPD communication and supplement it within 20 business days from that communication. A preliminary filing does not complete the Article 48 duty. Data-subject notices should be direct, individual, in simple language, and sent through a customary channel where possible; indirect public notice is exceptional and must be justified.

Resolution 15/2024 requires the controller to keep a record of security incidents involving personal data for at least five years, including incidents that were not communicated. The record should let a reviewer reproduce the threshold decision, clock calculation, notices, mitigation, and follow-up without relying on memory.

Close the incident only after containment and recovery are verified, required communications and supplements are complete, corrective actions have owners and dates, and the controller records whether the RIPD, processing inventory, contracts, security measures, retention rules, or data-subject guidance must change.