BrazilAnatel Cybersecurity Regulation for Telecommunications, notification of relevant incidents
Resolução nº 740 de 21 de dezembro de 2020 (Anatel), Regulamento de Segurança Cibernética Aplicada ao Setor de Telecomunicações, arts. 2º-C, 9º, 17 e 18
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a provider of collective-interest telecommunications services other than a small provider, with the extensions in articles 2-A and 2-B of the Annex (reached by declaring that you provide telecommunications services). A provider had 180 days from the Regulation's entry into force on , until , to comply (article 27).
- Notify Anatel of each relevant incident that substantially affects the security of telecommunications networks or of user data, with an analysis of its cause and impact and the mitigation actions adopted, in the form and by the procedure the GT-Ciber sets (article 17).
- Where the law requires you to report a security incident to the national data protection authority, also notify Anatel (article 2-C).
- Inform other providers and users of such an incident, as the case may be, without prejudice to other legal reporting duties (article 9).
- Adopt a procedure for sharing information on relevant incidents and other cybersecurity information in a confidential and non-discriminatory way, with anonymity allowed (article 18).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Anatel (Agência Nacional de Telecomunicações), which applies the administrative sanctions of Law 9,472 of 1997 to an infringement of the Regulation (article 25).
What this law does
Article 9 requires a provider to notify Anatel and to inform other providers and users, as the case may be, of the relevant incidents that substantially affect network security and user data. Article 17 requires a provider to notify Anatel of the relevant incidents that substantially affect the security of telecommunications networks and of user data. Article 17 requires the notification to include an analysis of the cause and impact and the mitigation actions adopted.
Article 17 leaves the form and procedure of the notification to the technical group GT-Ciber. Article 2-C requires a provider to notify Anatel where a security incident must be communicated to the national data protection authority. Article 18 requires providers to adopt a procedure for sharing information on relevant incidents in a confidential and non-discriminatory way. Article 25 subjects an infringement of the Regulation to the administrative sanctions of Law 9,472 of . Article 27 requires a provider to comply with the Regulation within 180 days of its entry into force.
When LexLint raises it
When your app profile says your app provides telecom services.