LGPD Data Breach Notification: When and How Companies Must Respond

“Data breach” is useful international shorthand, but Brazil's regulation uses the broader concept of a security incident involving personal data. That matters because the problem is not limited to public leaks. Loss of availability, unauthorized alteration, accidental disclosure, compromised authenticity, and other adverse events can also fall within incident-response analysis.

ANPD's glossary defines a security incident as a confirmed adverse event related to violation of the confidentiality, integrity, availability or authenticity of personal-data security.

Which Incidents Must Be Reported to ANPD?

ANPD's current incident page gives a useful three-part test. A security incident needs to be communicated when the following criteria are met cumulatively:

A vulnerability is not automatically an incident

ANPD expressly distinguishes a vulnerability from an incident. A vulnerability is a weakness. If it has not been exploited and no confirmed adverse event involving personal-data security has occurred, the organization may be dealing with a security weakness rather than a reportable incident.

That does not mean the weakness can be ignored. Article 46 requires technical and administrative security measures, and prevention is one of the LGPD's core principles. The distinction simply prevents vulnerability management from being confused with Article 48 notification.

What Does “Relevant Risk or Damage” Mean?

This is the core decision in many incidents. ANPD says the controller should assess factors including:

• the context of the processing activity;
• the categories and number of affected data subjects;
• the nature, categories and quantity of affected data;
• potential material, moral or reputational harm;
• whether affected data was protected so that identification of the data subjects was prevented; and
• whether post-incident mitigation measures were sufficient.

ANPD specifically identifies concerns such as discrimination, identity theft, financial fraud and other material or moral harms, with particular attention to incidents involving large-scale data, sensitive data and vulnerable groups such as children, adolescents or older persons.

The Current LGPD Incident Deadline: Three Business Days

Resolution CD/ANPD No. 15/2024 is currently listed by ANPD as in force. Under the current rule, communication to ANPD and affected data subjects generally must be made within three business days when the incident can cause relevant risk or damage, unless specific legislation applicable to the organization provides another notification deadline.

Qualifying small processing agents: double deadline

A valuable 2026 nuance is that the consolidated small-processing-agent regulation still provides a double deadline for qualifying small processing agents when communicating a reportable security incident to ANPD and data subjects under Resolution 15/2024.

Applied to the ordinary three-business-day period, that generally means six business days for an agent that validly qualifies for the differentiated regime.

What if you do not have all the facts by the deadline?

ANPD expressly provides for phased reporting in exceptional cases. If complete information is not yet available, the controller can submit a preliminary communication, explain why it is incomplete, and later provide complementary information in a reasoned manner.

ANPD's current guidance says the complementary information may be provided within 20 business days from the initial communication.

That makes one incident-response habit particularly dangerous: waiting for perfect forensic certainty before deciding whether the regulatory clock matters.

Controller vs Operator: Who Must Notify?

This distinction is especially important for SaaS, cloud, payroll, marketing, e-commerce and outsourced-service providers. A processor/operator contract that says “vendor will notify customer within applicable legal deadlines” can be operationally useless if the controller has only three business days and the operator itself waits two or three days before escalating.

ANPD recommends that incident-communication obligations between controllers and operators be established contractually so the process can move quickly and risks to data subjects can be reduced.

For a deeper role analysis, see our LGPD for SaaS Companies guide.

What Should the Controller Communicate to ANPD?

Article 48 lists minimum subject matter, and Resolution 15/2024 creates the current operational communication process. A controller should be prepared to assemble, at minimum, information around:

ANPD currently receives incident communications through electronic petitioning in the SEI!ANPD system. The communication is made by the encarregado or a legally constituted representative of the controller.

How Must Affected Data Subjects Be Notified?

ANPD says communication should happen as quickly as possible once the controller concludes that the incident can create relevant risk or damage. It should be direct and individualized whenever possible.

Communication channels can include:

• email;
• SMS;
• letter;
• electronic message; or
• preferably, another channel the organization already normally uses to communicate with the data subject.

If affected individuals cannot be individually identified despite confirmation of the incident, broader communication may be necessary. ANPD says indirect public communication can be used exceptionally and with justification, using a channel capable of reaching the greatest possible number of affected individuals and giving the notice appropriate prominence.

What should the data-subject notice contain?

According to ANPD's current incident page, the notice should use simple, easy-to-understand language and include at least:

1. the nature and categories of personal data affected;
2. the technical and security measures used to protect the data, respecting commercial and industrial secrecy;
3. the risks and possible impacts for data subjects;
4. the reason for delay if the notice was late;
5. measures already taken or planned to reverse or mitigate the effects;
6. the date the organization learned of the incident; and
7. a contact for further information and, where applicable, the encarregado's contact details.

Incident Records: The Five-Year Requirement

One of the most important but less-discussed requirements of Resolution 15/2024 is the incident register. The controller must maintain a record of security incidents—including incidents that were not communicated to ANPD or affected individuals—for at least five years from the date of the record, unless another obligation requires a longer period.

A defensible incident record should include at least:

• date the incident became known;
• general description of the circumstances;
• nature and category of affected data;
• number of affected data subjects;
• risk assessment and possible harm;
• correction and mitigation measures;
• form and content of communication where notification occurred; and
• the reasons for not communicating when the incident was determined to be non-reportable.

A 12-Step LGPD Security Incident Response Workflow

Common LGPD Incident-Response Mistakes

“We will decide whether to notify after forensics is complete.”

That can be dangerous. The regulatory period is short. Investigation and notification preparation should run in parallel, with preliminary reporting available where facts remain incomplete and the incident is reportable.

“Our vendor will notify ANPD for us.”

A vendor may help operationally, but Article 48 places the legal communication duty on the controller. Make sure the controller owns the reportability decision and filing process.

“No notification means no documentation.”

Incorrect. The incident register includes incidents not communicated to ANPD or data subjects, and the reasons for non-notification should be recorded.

“Encrypted data means the incident can never be reportable.”

Encryption can materially reduce risk and Article 48 says ANPD can consider whether technical measures made affected data unintelligible to unauthorized third parties. But the controller should assess the actual encryption, key exposure and incident facts, not rely on the word “encrypted” alone.

“A website press release is enough.”

Not when affected individuals can be identified and contacted. ANPD's preferred model is direct and individualized communication whenever possible.

What Should Be Tested Before an Incident?