After a breach, the urgency is usually all technical: contain, eradicate, restore. But a legal clock is running in parallel, and it does not wait for the forensics to finish.

What the law requires

Article 48 of the LGPD requires the controller to notify the ANPD and the data subjects of any security incident that may cause relevant risk or harm. Resolution CD/ANPD No. 15 of 24 April 2024 set the deadline: three business days from becoming aware of the incident. For small-scale processing agents, the deadline is doubled — six business days.

Where it is not possible to gather all the information in time, the notification can be made in stages. The preliminary part goes in within the deadline, with justification, and the remainder can be sent within twenty business days of the initial notification.

Notifying the data subject is a different matter

Notifying the authority and communicating with the data subject serve different audiences and should not use the same text. The data subject needs to understand, in clear and accessible language, which of their data was affected, what risk that represents and what they can do about it. Technical jargon and euphemism protect no one here — they simply shift the cost of the incident onto the person already harmed.

What to prepare before you need it

• A named person responsible for triggering the process, with a deputy.

• Ready-made communication templates — for the ANPD, for data subjects and for the press.

• A documented criterion for what the organization considers