Confirm whether personal data was affected, record when the learned that fact, and assess whether the incident may cause relevant risk or damage.
When the reporting threshold is met, the must notify the ANPD and affected data subjects within three business days, unless sector-specific law sets another period.
Use this workflow to handle a Brazil LGPD from the first alert through risk assessment, ANPD and data-subject notices, mitigation, supplementation, and final records.
Open the privacy incident workflow when an event may have affected the confidentiality, integrity, availability, or authenticity of personal data. A vulnerability with no confirmed adverse event is not itself an incident, and an event involving only effectively anonymized data does not require an LGPD incident notice. Preserve logs and evidence while security contains the event.
The notification test has three cumulative parts: the incident is confirmed, it involves personal data subject to the LGPD, and it may cause relevant risk or damage to data subjects. Assess the processing context, categories and number of people, nature and amount of data, possible material, moral, or reputational harm, effective protection such as encryption, mitigation already completed, large-scale effects, sensitive data, and vulnerable groups.
Treat compromise of authentication credentials, financial or payment data, protected secrets, sensitive data, or data about children and other vulnerable people as a strong risk indicator, especially at scale or where fraud, identity theft, discrimination, physical harm, or denial of a service is plausible. The category alone does not replace the case-specific threshold assessment; record how exposure, protection, duration, recoverability, and completed mitigation change the likely harm.
The owns the reportability decision and notifications. An must inform the controller without unjustified delay and supply the information needed for the assessment and notices. Contractual escalation periods should be short enough for the controller to meet the legal clock.
Sources (3)
Current ANPD guidance for the cumulative reporting test, risk factors, controller and operator roles, notice timing, and notice content.
Binding regulation for the reportability test, controller and operator duties, three-business-day notices, staged communication, and incident records.
Article 48 assigns the communication duty to the controller and identifies the minimum statutory subject matter.
Notify the ANPD and affected data subjects within three business days from the 's knowledge that the incident affected personal data, unless specific legislation sets another period. Resolution 2/2022 gives qualifying small processing agents double time under the incident regulation. A team should confirm that status before relying on the extension.
If complete information is unavailable, submit a justified preliminary ANPD communication and supplement it within 20 business days from that communication, or 40 business days for qualifying small processing agents under Article 6(8). A preliminary filing does not complete the Article 48 duty. Data-subject notices should be direct, individual, in simple language, and sent through a customary channel where possible; indirect public notice is exceptional and must be justified.
Sources (2)
Current ANPD instructions for the three-business-day period, preliminary and complementary filings, and direct data-subject communication.
Article 14, as amended by Resolution 15/2024, provides the differentiated incident-notification period for qualifying small processing agents.
Resolution 15/2024 requires the to keep a record of security incidents involving personal data, including incidents that were not communicated, for at least five years from registration, unless another duty requires longer retention. Article 10(2) provides an exception for Article 23 public bodies that follow applicable permanent-record archival rules. The record should let a reviewer reproduce the threshold decision, clock calculation, notices, mitigation, and follow-up without relying on memory.
Close the incident only after containment and recovery are verified, required communications and supplements are complete, corrective actions have owners and dates, and the records whether the RIPD, processing inventory, contracts, security measures, retention rules, or data-subject guidance must change.
Sources (2)
Current ANPD guidance and Resolution 15/2024 summary, including the five-year incident-record requirement and reassessment process.
Articles 46-49 support security measures, continuing security obligations, incident communication, and system design.
Assign detection, investigation, reportability, notices, remediation, and records to named owners.
Turn Incident Workflow into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review incident scope, evidence, owners, notices, and next actions.
How ANPD investigates LGPD infringements, classifies severity, selects sanctions, calculates fines, and weighs aggravating and mitigating evidence.
Apply LGPD Articles 3 and 4 to a processing activity, including foreign organisations, Brazil collection, targeting, exclusions, and the evidence to retain.
Apply Brazil's LGPD incident notification test, three-business-day clock, notice content, phased filing, affected-person communication, and five-year records.
An evidence-based Brazil LGPD checklist for scope, roles, legal bases, notices, rights, vendors, security incidents, transfers, retention, and governance.
Build an LGPD compliance program from processing records, legal bases, transparency, rights, security, vendors, transfers, incidents, and accountable evidence.
Classify LGPD controller, operator, sub-operator, and encarregado roles from actual decisions, instructions, processing facts, and Resolution 18 duties.
Brazil LGPD rights guide covering confirmation, access, correction, restriction, deletion, portability, consent, sharing, objection, and automated decisions.
Track Brazil LGPD commencement dates, data-access responses, incident notices, international-transfer clauses, and ANPD fine-payment deadlines.
Build an LGPD data-subject response that identifies the right, applies the correct timing, records the decision, protects third parties, and proves delivery.
Run an LGPD data-subject request from intake and identity checks through rights analysis, response timing, evidence, exceptions, and escalation.
Decide whether an LGPD incident is reportable, calculate the ANPD deadline, prepare complete or staged notices, and keep the required five-year record.
Compare LGPD international-transfer mechanisms: adequacy, ANPD standard clauses, approved specific clauses, global corporate rules, consent, and other Article 33 routes.
Brazil LGPD international-transfer guide for identifying transfers, selecting Article 33 mechanisms, applying ANPD clauses, EU adequacy, and transparency.
Compare LGPD Article 7 bases for ordinary personal data and Article 11 bases for sensitive data, with consent, necessity, evidence, and edge cases.
Apply LGPD legitimate interest through purpose, necessity, balancing, reasonable expectations, safeguards, children, sensitive-data limits, and records.
Understand every ANPD administrative sanction under LGPD Article 52, the fine ceilings, non-monetary penalties, and public-body limits.
Answers to common Brazil LGPD questions about scope, roles, legal bases, rights, incidents, transfers, impact reports, small agents, and enforcement.
Reference guide to Brazil LGPD scope, principles, legal bases, transparency, rights, roles, security, incidents, transfers, records, and ANPD oversight.
Build an LGPD RIPD evidence file that proves the processing scope, high-risk screen, necessity, safeguards, residual risk, approval, and later review.
Decide when to prepare an LGPD RIPD, apply the ANPD high-risk screen, document required evidence and mitigation, approve residual risk, and review changes.
Check whether an organization qualifies for Brazil's small-processing-agent regime, which flexibilities apply, and which LGPD duties remain unchanged.
Choose and maintain LGPD templates for processing records, data-subject requests, incidents, RIPDs, transfers, and controller-operator role evidence.
Classify an LGPD international transfer, confirm the processing legal basis and transfer mechanism, document onward transfers, and approve the evidence before launch.
Compare Brazil's LGPD and California's CCPA by scope, legal bases, consumer rights, sale and sharing rules, deadlines, transfers, and enforcement.
Compare Brazil's LGPD and the EU GDPR by scope, legal bases, roles, rights deadlines, impact assessments, incidents, transfers, and enforcement.
Apply LGPD Article 14 to children's and adolescents' data: age categories, best interests, legal bases, parental consent, limited collection, notices, and evidence.
Compare actual decision rights with contracts, operator instructions, sub-operator approvals, and the encarregado channel.
Test tracker classification, legal bases, banner choices, stored preferences, and deployed network behavior.
Assign the reportability decision, knowledge timestamp, ANPD filing, affected-person notice, and follow-up evidence.
Match each exporter, importer, onward flow, and processing basis to the selected Article 33 mechanism.
Record each purpose, data category, statutory basis, necessity, notice, retention, and reassessment trigger.
Document the interest, necessity, alternatives, expectations, impacts, effective safeguards, and approval.
Assign the report trigger, processing description, risk assessment, safeguards, controller decision, and mitigation checks.
Organize the infringement facts, classification, revenue inputs, mitigation evidence, and procedural deadlines.
Verify eligibility, group revenue, the two-part high-risk screen, each flexibility used, and continuing duties.