How does the Brazilian timeline compare with the GDPR?

Topic LGPD (Brazil) GDPR (EU) Authority deadline Three business days 72 hours Data subject notice Three business days, when there is relevant risk Without undue delay, when high risk Supplementary information Up to 20 business days In phases, without undue delay Internal record All incidents, kept for at least five years All breaches documented Groups with a global incident response plan should adjust it: in practice, the Brazilian deadline may expire before the facts are fully known, so the first notice should be filed with the information available.

Data breach Brazil: LGPD notification duties and timelines

Q: When is notification required?

Notification is mandatory when the incident may cause relevant risk or damage to data subjects. Under the ANPD regulation, this is the case when the incident may significantly affect their interests and fundamental rights and involves at least one of the following: sensitive data, data of children, adolescents or elderly people, financial data, authentication credentials, data protected by legal or professional secrecy, or large-scale data. Incidents that do not meet this threshold must still be assessed and recorded, with the reasons for not notifying.

After a data breach in Brazil, the controller must notify the National Data Protection Agency (ANPD) and the affected individuals within three business days when the incident may cause relevant risk or damage to them. The deadline runs from the moment the controller learns that personal data was affected. The rules are in Article 48 of the LGPD and in Resolution CD/ANPD No. 15/2024, which also requires every incident to be recorded, whether notified or not.

Key points

Deadline: three business days for the ANPD and for data subjects.
The clock starts when the controller knows personal data was affected.
Supplementary information may follow within 20 business days, with justification.
All incidents must be recorded and records kept for at least five years.
Small processing agents have double deadlines.

When is notification required?

Notification is mandatory when the incident may cause relevant risk or damage to data subjects. Under the ANPD regulation, this is the case when the incident may significantly affect their interests and fundamental rights and involves at least one of the following: sensitive data, data of children, adolescents or elderly people, financial data, authentication credentials, data protected by legal or professional secrecy, or large-scale data. Incidents that do not meet this threshold must still be assessed and recorded, with the reasons for not notifying.

Topic	LGPD (Brazil)	GDPR (EU)
Authority deadline	Three business days	72 hours
Data subject notice	Three business days, when there is relevant risk	Without undue delay, when high risk
Supplementary information	Up to 20 business days	In phases, without undue delay
Internal record	All incidents, kept for at least five years	All breaches documented

Groups with a global incident response plan should adjust it: in practice, the Brazilian deadline may expire before the facts are fully known, so the first notice should be filed with the information available.

What must the notice to the ANPD include?

The notice is filed through the ANPD’s electronic form and must cover, among other points:

a description of the incident and its main cause, if known;
the nature and categories of affected data and the number of affected individuals;
security measures in place before and after the incident;
risks and likely consequences for data subjects;
measures taken to reverse or mitigate the effects;
reasons for any delay, relevant dates and the DPO’s contact details.

How should individuals be informed?

The notice to data subjects must use clear language and, whenever possible, be sent individually by email, app message or letter. It should explain what happened, which data was affected, the risks, what the company is doing and what individuals can do to protect themselves, with a contact channel. If individuals cannot be identified or reached, the company must publish the notice on its website, app or social media for at least three months.

What should a foreign company do in advance?

Designate who in Brazil decides on notification and who files it with the ANPD.
Translate notice templates into Portuguese.
Require processors and vendors to report incidents quickly, by contract.
Prepare a risk assessment matrix aligned with the ANPD criteria.
Keep an incident register that covers Brazilian operations.
Coordinate with cyber insurers, whose policies often have their own notice deadlines.

What are the consequences of failing to notify?

The ANPD may open an enforcement proceeding and impose sanctions such as warnings, fines of up to 2% of revenue in Brazil (capped at BRL 50 million per infraction) and publication of the infraction. Timely, well-documented notification is taken into account when penalties are set. Failure to notify also increases exposure to consumer claims and reputational damage.

Frequently asked questions

Does the processor notify the ANPD?

No. Notification is the controller’s duty. The processor must inform the controller promptly and cooperate, which should be set out in the contract.

Is ransomware without confirmed data exfiltration a reportable incident?

It may be. Loss of availability is also a security incident and can create relevant risk, especially in health or financial services.

Who is a small processing agent?

Micro and small companies, startups and similar entities defined in Resolution CD/ANPD No. 2/2022, provided they do not carry out high-risk processing.

How Chambarelli Advogados can help

Our Regulation of New Technologies team and our Foreign Desk adapt global incident plans to Brazilian rules and handle ANPD notifications. Book a meeting with one of our partners.

Informational content, updated October 2026. It does not replace advice on your specific case.

Data breach in Brazil: notification duties and timelines