BrazilLGPD, security incident notification
Lei nº 13.709, de 2018 (LGPD), art. 48 (security incident notification)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- Notify the ANPD and the affected data subjects of a security incident that may create relevant risk or harm to data subjects, within the reasonable period the ANPD sets by regulation, and state the reasons for the delay when the notice is not immediate.
- Describe in the notification the nature of the personal data affected, the data subjects involved, the technical and security measures used, the risks related to the incident, and the measures taken or planned to reverse or mitigate its effects.
- Expect the ANPD to assess the incident's severity, and comply if it orders wide publicity of the incident or measures to reverse or mitigate its effects.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 48 requires the controller to communicate to the national authority and to the data subject a security incident that may cause relevant risk or damage, and lists what the communication must say. It is a duty to notify and sets no duty to document incidents that are not notified, and it names no log or record.
- Kind
- None
- As of
What this law does
Article 48 requires the controller to notify the ANPD and the data subject of a security incident that may create relevant risk or harm to data subjects.
The notification runs on a reasonable period the ANPD itself defines by regulation rather than a fixed number of hours or days stated in the LGPD, and paragraph 1 requires it to describe, at minimum, the nature of the personal data affected, information about the data subjects involved, the technical and security measures used, the risks related to the incident, the reasons for any delay, and the measures taken or planned to reverse or mitigate the harm.
Paragraph 2 lets the ANPD assess the incident's gravity and order the controller to give the incident wide publicity in the media or to adopt measures reversing or mitigating its effects, and paragraph 3 lets the ANPD weigh, in that assessment, whether the controller had already rendered the affected data unintelligible to unauthorized third parties.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .