Brazil. Breach notification. Regulation
ANPD Res. 15/2024Resolution CD/ANPD No. 15/2024 - Regulation on Security Incident Reporting
In force
Partly verified
Medium confidence.Exact adoption/publication dates from general knowledge; DLA Piper confirms April 2024.
§1Summary
- Synopsis
Defines when a security incident must be reported to the ANPD and data subjects, the content of notices and record-keeping. Incidents with relevant risk or harm must be notified within three working days.
- Key themes
- Unique features
Lists specific high-risk triggers (sensitive data, children/elderly, financial data, credentials, large scale) and requires an incident log retained for five years.
- SaaS relevance
SaaS controllers must report qualifying incidents within three working days; processors must support controllers promptly.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- ANPD + data subjects within 3 working days; supplement within 20 working days
- Maximum penalty
- As per LGPD
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text gov.br
- Authority
- Agência Nacional de Proteção de Dados (ANPD)
§5Where it applies
- Domestic law of
- Brazil
§6Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence.Exact adoption/publication dates from general knowledge; DLA Piper confirms April 2024.