BrazilANPD Regulation on Reporting Security Incidents (Resolution CD/ANPD No. 15/2024)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Notify the ANPD of a security incident that may create relevant risk or damage to data subjects within three business days of learning that it affected personal data, unless a specific law sets another period, and send the notice through the data protection officer or an authorized representative on the ANPD's electronic form.
- Include in the notice to the ANPD the nature and category of the data affected, the number of data subjects, the security measures used before and after the incident, the risks and possible impacts, the reasons for any delay, the measures taken or planned, the dates of the incident and of your knowledge of it, the officer's details, the controller's identification, and the other particulars article 6, paragraph 2 lists.
- Notify the affected data subjects within three business days of learning that the incident affected personal data, in plain language, and directly and individually where you can identify them.
- Where direct and individual notice is not feasible or the data subjects cannot be identified, announce the incident within the same period through means such as your website, applications, social media and service channels, so that it stays visible for at least three months.
- Keep a record of every security incident, including one not reported to the ANPD or to data subjects, for at least five years, stating the date you learned of it, the circumstances, the nature and category of data, the number of data subjects, the risk assessment, the corrective measures, the form and content of any notice, and the reasons for not giving notice.
These lines are LexLint's reading of the law's text.
What it makes you log
What the log must hold
Event time, Disclosure shown
Log retention
The five years run from the date of the record, unless other obligations require a longer period.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Article 10 requires the controller to keep a record of every security incident, including one that was not reported, and lists the minimum content of the record.
- Kind
- Explicit
- As of
- Provision
- Resolução CD/ANPD nº 15/2024, Anexo, art. 10
- Trigger
- security_incident
What this law does
Article 6 requires the controller to notify the ANPD of a security incident within three business days, unless a specific law sets another period. The three business days run from the moment the controller learns that the incident affected personal data.
An incident may create relevant risk or damage to data subjects when it can significantly affect their fundamental interests and rights and involves at least one of sensitive data, data of children, adolescents or the elderly, financial data, system authentication data, data under legal, judicial or professional secrecy, or large-scale data. Article 9 requires the controller to notify the affected data subjects within the same three business days.
Where direct and individual notice is not feasible or the data subjects cannot be identified, the controller must still announce the incident, within the same period, through means such as its website, applications, social media and service channels, in a way that keeps it visible for at least three months.
Article 10 requires the controller to keep a record of every security incident, including one not reported to the ANPD or to data subjects, for at least five years from the date of the record. The period for notifying the ANPD is counted double for small-scale processing agents.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .