Brazil LGPD Incident Workflow

Start by confirming whether the event is a security incident involving personal data and whether it may create risk or relevant harm to data subjects, as described in article 48 of the LGPD. If the event does not involve personal data or does not present that risk, document the assessment and close the workflow with the supporting evidence.

If the event is in scope, gather the facts needed for the ANPD communication: the nature of the affected data, the data subjects involved, the technical and security measures already in place, the risks linked to the incident, the reason for any delay, and the measures taken or planned to reduce the harm. The ANPD form also asks who discovered the incident, when it occurred, when the controller became aware of it, when it was reported to ANPD, and when data subjects were informed.

For incidents that still lack enough information, use a preliminary communication only as a temporary step and follow up with a complete or complementary communication when the facts are confirmed. The workflow should also record the internal owner, the DPO or privacy lead, the operator if one was involved, and any communication made to other authorities or to the affected data subjects.

A useful template captures role, purpose, lawful basis, data subject, category, transfer or incident trigger, owner, evidence, and ANPD/DPO escalation note.

Review the workflow after ANPD guidance, new vendors, new purposes, cross-border changes, incidents, complaints, or changes to data-subject channels.