On Tuesday morning, IT says "a few thousand customers" were affected. The three-business-day deadline is already running, and the notification has to go out with numbers nobody has measured.
When to notify, what each field requires, how to inform data subjects and how the expert report supports the supplementary filing and the defence.
The LGPD (Brazil's data protection act) requires the ANPD (Brazil's National Data Protection Agency) and the data subjects to be notified of any incident that may cause relevant risk or harm. The ANPD regulation allows three business days, counted from when the controller learns that personal data were affected, and asks for twelve items of information. Almost all of them are technical facts: data affected, number of data subjects, vulnerable individuals, date, cause.
In the first hours, these facts are estimates, and the estimate errs in both directions. A team that feels at fault plays it down. Another reports an incident larger than the analysis later shows. The gap draws the ANPD's attention and leads to requests for supplementary information.
The course shows how to notify with what is known, flag what is an estimate, supplement with an expert report and keep the record that carries weight later.
Pick as many courses as you like: they are kept and arrive ticked on the registration form.
A company had to notify the ANPD of a large-scale incident, and the numbers from the first hours were estimates. The examination delimited the incident, separated the data subjects into exposure groups, identified the vulnerable individuals and placed the technical details in a confidential annex. The report provided the basis for the supplementary filing.
A company was accused of sharing users' data through its website without consent. The opinion examined the scripts, the data sent in each flow and the copy of the website filed by the claimant, and showed that there had been no violation. The case was closed without a court-ordered examination.
A school notices that someone copied its enrolment database, with data on underage students and their parents or guardians. The deadline is already running, and nobody knows how many students were affected. The examination preserves the logs, delimits the period and the account used, counts children and adolescents separately and delivers first what the notification requires.
In groups, participants receive the scenario of a breach at an online shop, with what IT knows 30 hours after discovery. In 15 minutes, they mark each of the twelve fields as measured, estimated or unknown, indicate the technical source that will close it and decide what is left for the supplementary filing.
Laws and rulings discussed
LGPD, art. 48 (Brazil's data protection act) · LGPD, arts. 43 and 55-A · CD/ANPD Resolution No. 15/2024, arts. 3º and 5º to 10 (ANPD, Brazil's National Data Protection Agency) · CD/ANPD Resolution No. 4/2023, arts. 8º and 13 · STJ (Brazilian Superior Court of Justice), AREsp 2,130,619/SP · STJ, REsp 2,121,904/SP
See also
LGPD, ANPD and Data Breach Forensics → Forensic Services in Insurance and Cyber Claims → Cloud, Identity and DevOps Forensics → Expert Reports and Opinions → See all courses →