Duty LXD-7264
Provides telecom services, in Brazil
Brazilian Inclusion Law, Accessible Telecommunications and Sound and Image Broadcasting Servicessince 3 lines
Arts. 65 e 67 da Lei nº 13.146, de 6 de julho de 2015 (Lei Brasileira de Inclusão da Pessoa com Deficiência) · Read the law's page
- Article 65 leaves the content of the duty to specific regulation, and the Act names no technical standard.
- If you provide telecommunications services, guarantee full access to persons with disabilities, as specific regulation provides (LBI Art. 65).
- If you provide sound and image broadcasting services, allow the use of closed captioning, a window with a Libras interpreter and audio description, among other resources (LBI Art. 67).
Anatel Cybersecurity Regulation for Telecommunications, security policy and controlssince 6 lines
Resolução nº 740, de 21 de dezembro de 2020 (Anatel), Regulamento de Segurança Cibernética Aplicada ao Setor de Telecomunicações, arts. 2º, 6º, 7º, 13, 19 e 20 · Read the law's page
- This binds a provider of collective-interest telecommunications services other than a small provider, with the extensions in articles 2-A and 2-B of the Annex (reached by declaring that you provide telecommunications services). The Regulation entered into force on and a provider had 180 days to comply, until (article 27).
- Prepare, implement and maintain a Cybersecurity Policy approved by your board of directors or an equivalent collegiate body, with a director responsible for it, and keep it available to Anatel on request (articles 6, 13 and 14).
- Use telecommunications products and equipment only from suppliers that hold a cybersecurity policy compatible with the Regulation and undergo periodic independent audits, and make the audit results available to Anatel on request (article 7).
- Run cybersecurity vulnerability assessment cycles carried out by an independent assessing body or qualified company, and submit the results to Anatel (articles 10 and 19).
- Send Anatel information on your Critical Telecommunications Infrastructures, covering at least network data and geographic mapping of physical structures and routes (article 20).
- Publish an extract of your Cybersecurity Policy with its non-sensitive information on your website, and give Anatel a report on the execution of the Policy every year or when it asks (articles 15 and 16).
Anatel Cybersecurity Regulation for Telecommunications, notification of relevant incidentssince 5 lines
Resolução nº 740, de 21 de dezembro de 2020 (Anatel), Regulamento de Segurança Cibernética Aplicada ao Setor de Telecomunicações, arts. 2º-C, 9º, 17 e 18 · Read the law's page
- This binds a provider of collective-interest telecommunications services other than a small provider, with the extensions in articles 2-A and 2-B of the Annex (reached by declaring that you provide telecommunications services). A provider had 180 days from the Regulation's entry into force on , until , to comply (article 27).
- Notify Anatel of each relevant incident that substantially affects the security of telecommunications networks or of user data, with an analysis of its cause and impact and the mitigation actions adopted, in the form and by the procedure the GT-Ciber sets (article 17).
- Where the law requires you to report a security incident to the national data protection authority, also notify Anatel (article 2-C).
- Inform other providers and users of such an incident, as the case may be, without prejudice to other legal reporting duties (article 9).
- Adopt a procedure for sharing information on relevant incidents and other cybersecurity information in a confidential and non-discriminatory way, with anonymity allowed (article 18).