BrazilSUSEP Circular 638 of 2021, Notification of Relevant Incidents
Circular SUSEP nº 638, de 27 de julho de 2021, arts. 2º, 6º e 8º
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds an insurance company, an open private pension entity, a capitalization company or a local reinsurer supervised by the Superintendência de Seguros Privados (reached by declaring that you are an insurer). It applies from , with adaptation periods that ended on for segments S1 and S2 and on for segments S3 and S4 (article 17).
- Notify the Susep of the occurrence of a relevant incident within a maximum of 5 business days from the day you become aware of the event, detailing the extent of the damage and, where applicable, the actions under way to fully regularize the situation, those responsible and the deadlines (article 8). A relevant incident is an adverse event, whether or not from malicious activity, that substantially compromises, under parameters you set, the confidentiality, integrity or availability of relevant data or of relevant data processing or storage services (article 2, item VI).
- In your incident-handling procedures, communicate with the parties affected by the incident, above all customers (article 6, item VII).
- In your incident-handling procedures, share information on relevant incidents with the other supervised entities in a mutually agreed format, protecting confidential information and trade secrets (article 6, item VI).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Superintendência de Seguros Privados, which applies the administrative penalties of article 108 of Decreto-Lei nº 73/1966 to an infraction of the norms on insurance and capitalization.
Settledness
- As of
- Open questions
- Does article 108 of Decreto-Lei nº 73/1966, as redrafted by Lei Complementar nº 213 of 2025, change the penalties that apply to a breach of the Circular?
What this law does
Article 8 requires a supervised entity to notify the Susep, within a maximum of 5 business days from becoming aware of the event, of the occurrence of relevant incidents, detailing the extent of the damage and, where applicable, the actions under way to fully regularize the situation and those responsible and the deadlines.
Article 2 defines relevant incidents as adverse events, whether or not from malicious activity, that substantially compromise, under parameters the supervised entity sets, the confidentiality, integrity or availability of relevant data or relevant data processing or storage services. Article 6, item VII, requires the incident-handling procedures to include communication with the parties affected by the incident, above all customers.
Article 6, item VI, requires the incident-handling procedures to include sharing information on relevant incidents with the other supervised entities, in a mutually agreed format. Article 1 of Circular SUSEP nº 638 sets cybersecurity requirements for insurers, open private pension entities, capitalization companies and local reinsurers. Article 18 provides that the Circular enters into force on .
Article 108 of Decreto-Lei nº 73/1966 subjects a person responsible for an infraction of the norms on insurance, co-insurance, reinsurance, retrocession and capitalization to administrative penalties applied by the supervisory body.
When LexLint raises it
When your app profile says your app is an insurer.