CHAPTER VIISECURITY AND GOOD PRACTICES

Section I - The National Authority for Protection of Data (“ANPD”)
Art. 55 - (vetoed)Art. 56 - (vetoed)Art. 57 - (vetoed)
Section II - The National Board for the Protection of Personal Data and Privacy
Art. 58 - (vetoed)Art. 59 - (vetoed)

  • Home
  • Brazil LGPD
  • CHAPTER VII
  • Art. 48

Art. 48

Authority Control Controller Damage Data subjects Incident National authority Risk Security Security
The controller must communicate to the national authority and to the data subject the occurrence of a security incident that may create risk or relevant damage to the data subjects.
Authority Fine National authority Shall
§1 The communication shall be done in a reasonable time period, as defined by the national authority, and shall contain, as a minimum:
Affected Personal data
I – a description of the nature of the affected personal data;
Data subjects
II – information on the data subjects involved;
Measures Security Security
III – an indication of the technical and security measures used to protect the data, subject to commercial and industrial secrecy;
Incident Risk
IV – the risks related to the incident;
V – the reasons for delay, in cases in which communication was not immediate;
and
Adopt Damage Measures Mitigate
VI – the measures that were or will be adopted to reverse or mitigate the effects of the damage.
Adopt Authority Control Controller Data subjects Incident Measures National authority Necessary Rights Safeguard Shall
§2 The national authority shall verify the seriousness of the incident and may, if necessary to safeguard the data subjects’ rights, order the controller to adopt measures, such as:
Disclosure Incident Measures Mitigate
I – broad disclosure of the event in communications media; and II – measures to reverse or mitigate the effects of the incident.
Access Adopt Affected Incident Measures Personal data Technical measures Third parties
§3 When judging the severity of the incident, eventual demonstration that adequate technical measures were adopted to render the affected personal data unintelligible will be analysed, within the scope and the technical limits of the services, to third parties who were not authorised to access them.