LGPD Art.48: Art. 48: Communicating security incidents to the ANPD and data subjects

The controller must communicate to the ANPD and to the data subject any security incident that may cause relevant risk or damage to data subjects, within a reasonable period defined by the ANPD (three business days under Resolution CD/ANPD 15/2024), stating at least the nature of the personal data affected, information on the data subjects involved, the technical and security measures used to protect the data (respecting secrets), the risks related to the incident, the reasons for any delay, and the measures taken or to be taken to reverse or mitigate the harm. The ANPD judges the seriousness of the incident, taking account of proof that the data were made unintelligible to unauthorised third parties, and may order wide disclosure in the media and measures to reverse or mitigate its effects. Individual leaks or unauthorised access may be settled by direct conciliation between controller and data subject, failing which sanctions apply (Art. 52 paragraph 7).