Under Brazil's LGPD (Lei Geral de Proteção de Dados, the General Data Protection Law), a controller must tell the National Data Protection Agency (ANPD) and the people affected about a security incident that may cause them relevant risk or damage. The deadline is 3 working days, counted from the moment the controller learns that the incident affected personal data. Article 48 of the LGPD sets the duty, and the ANPD's Security Incident Communication Regulation, Resolution CD/ANPD No. 15 of 24 April 2024, sets the deadline, the content of each notice and a register of every incident.
Compared with the GDPR's 72 hours, Brazil counts working days, so a controller can end up with a little more time. The people affected, though, must hear within the same window as the regulator, not only when the risk is high. Breach deadlines are one of the places where privacy laws differ most from country to country, which is why the privacy laws by region overview treats each one separately.
Article 48 sets the duty and the ANPD set the clock
The law itself never gave a number. Article 48(1) says the communication must be made in a reasonable time, "as defined by the national authority", and for almost four years that definition did not exist.
Resolution CD/ANPD No. 15/2024 filled the gap. Article 6 gives the controller 3 working days to notify the ANPD, and Article 9 gives the same 3 working days to notify the people affected, both counted from the moment the controller knows that personal data was involved. A specific law with its own communication deadline takes precedence. Small processing agents, as defined in Resolution CD/ANPD No. 2/2022, have both deadlines doubled to 6 working days. As of October 2026, these are the deadlines in force, and the ANPD that enforces them has been a regulatory agency since Law 15.352 of 25 February 2026.
The LGPD incident clock, from discovery to the register
The two-part test for relevant risk or damage
Not every incident has to be reported. Article 5 of the Regulation says an incident may cause relevant risk or damage when it can significantly affect the interests and fundamental rights of the people concerned and, at the same time, involves at least one of these:
- Sensitive personal data
- Data of children, adolescents or older people
- Financial data
- Authentication data for systems, such as passwords
- Data protected by legal, judicial or professional secrecy
- Data at large scale
Both parts must be met. A leaked mailing list of 200 business contacts might involve none of the criteria, while a stolen customer database with card details meets both almost by definition.
An incident that fails the test is still not forgotten. Article 10 requires the controller to keep a record of every security incident, including the ones it did not report, for at least 5 years from the date of the record.
What the notice to the ANPD must contain
Article 48(1) of the LGPD lists the minimum content of a notice:
- A description of the nature of the affected personal data
- Information on the data subjects involved
- The technical and security measures used to protect the data, without revealing trade or industrial secrets
- The risks related to the incident
- The reasons for any delay, if the communication was not immediate
- The measures taken or planned to reverse or reduce the effects of the damage
Article 6 of the Regulation asks for more. The notice also gives the date of the incident where it can be determined and the date the controller learned of it, the number of people affected with children, adolescents and older people counted separately, a description of the incident and its root cause where known, and the contact details of the data protection officer. If something is still missing after 3 working days, the controller can complete the notice, with reasons, within 20 working days of sending it.
What the people affected must be told
The communication to data subjects follows Article 9 of the Regulation. It must be written in simple, clear language and sent directly and individually wherever the people affected can be identified. It covers the nature and category of the data, the security measures used, the risks and possible impacts, any reasons for delay, the measures taken, the date the controller learned of the incident and a contact for further information.
What the ANPD can order after it hears from you
Once a notice arrives, Brazil's national authority assesses how serious the incident is. Under Article 48(2), it can order the controller to publicise the incident widely in the media and to take specific measures to reverse or reduce its effects.
Article 48(3) rewards good security. When the ANPD judges severity, it considers evidence that the controller made the affected data unintelligible to anyone without authorised access, for example through encryption. Stolen data that cannot be read is a much smaller problem than a plain-text export.
A late or missing notice is itself an infringement. The sanctions in Article 52 run from a warning to fines of up to 2% of revenue in Brazil, capped at R$50 million per infringement.
Controllers and processors share the liability
Article 42 makes the controller or the processor that causes material, moral, individual or collective damage in breach of data protection law liable to compensate for it. The split between controller and processor matters here: a processor is jointly liable when it fails to meet its legal obligations or acts against the controller's lawful instructions.
| Party | Role when an incident happens |
|---|---|
| Controller | Applies the risk test, notifies the ANPD and the people affected within 3 working days, records every incident and acts to reduce the damage. |
| Processor | Processes data only on the controller's instructions (Article 39) and is jointly liable if it breaks the law or those instructions. |
| ANPD | Assesses the severity of the incident and can order media disclosure or further measures. |
Security duties run from design to after processing ends
Notification is the last line of the LGPD's security chapter, not the first. Article 46 requires technical and administrative measures that protect personal data from unauthorised access and from accidental or unlawful destruction, loss, alteration or disclosure, and those measures apply from the design of a product or service onwards.
The duty outlives the processing itself (Article 47), and the systems that hold the data must be built to meet security requirements and good governance practice (Article 49). In practice, the questions a regulator asks after an incident (what you held, where it went, who could reach it) are easier to answer when you already know where personal data flows, including through the third-party scripts on your website.
Short answers on LGPD breach notification
Who do I need to notify if a data breach occurs under the LGPD?
The controller notifies the ANPD and the affected data subjects when the incident may cause them relevant risk or damage. Incidents below that threshold go into the controller's incident register instead.
How quickly must the notification be sent to the ANPD?
Within 3 working days of the controller learning that the incident affected personal data, under Resolution CD/ANPD No. 15/2024. Small processing agents have 6 working days, and missing information can be added, with reasons, within 20 working days of the notice.
Does every minor security event require reporting?
No. An incident must be reported when it can significantly affect people's interests and fundamental rights and involves at least one criterion such as sensitive, financial or children's data or large scale. Every incident, reported or not, must still be recorded and kept for at least 5 years.
What happens if data is stolen but it was encrypted?
Under Article 48(3), the ANPD considers evidence that the data was unintelligible to unauthorised parties when it judges how serious the incident is. Encryption can lower the severity, but the controller still assesses the risk and records the incident.
Can the ANPD force a company to go to the press about a breach?
Yes. Where it is needed to protect the people affected, Article 48(2) lets the ANPD order wide disclosure of the incident in the media, along with measures to reverse or reduce its effects.
Know which scripts can reach your visitors' data
An incident register is only as good as your map of where personal data goes, and on a website that map includes every third-party script. Kukie.io's free Script audit lists the third-party domains one page loads, the service and category behind each and whether it sets cookies before a choice.
