When an incident reaches personal data, the decision to notify the ANPD, and what to notify, depends on facts that only the evidence shows. The examination measures those facts and supports the company in what comes next.
The LGPD, the Brazilian data protection law, requires the controller to notify the ANPD (Brazil's data protection authority) and the data subjects of any security incident that may cause relevant risk or harm (LGPD, art. 48). The deadline is three business days, counted from when the controller learns that the incident affected personal data (ANPD Resolution 15/2024, the regulation on incident notification, art. 6º).
Whether or not to notify depends on questions that no legal opinion answers on its own. Which data were affected, and of how many data subjects? Are there sensitive, financial, children's or elderly people's data? Since when did the access exist? The answers are in the records and the equipment, and it is the forensic examination that extracts them.
The work is forensic, not LGPD compliance and not the role of the data protection officer (DPO). The decision stays with the controller and its lawyers. What changes is the basis: a technical expert report on the security incident, rather than an estimate made under pressure. That estimate tends to err in both directions. The technology team feels guilty for not having prevented the incident, and the fear of exposing the severity of what happened is natural: the number comes out lower than the real one. In other cases the opposite occurs: the team reports an incident that the forensic analysis later shows to be much smaller. The discrepancy raises eyebrows at the ANPD and leads to supplementary requests and more delicate proceedings.
Classifying the severity of the incident and the type of risk each group of data subjects faces is part of the same work. It is what guarantees a complete notification and allows data subjects to be warned in time, before one of them falls victim to a scam. It is also what protects the company's image.
Data leaks have become the starting point for a large share of digital crime. With name, taxpayer number (CPF) and purchase history in hand, the criminal runs scams against the company's customers and employees, and the fraud spreads across many victims, which makes authorship harder to establish.
That is why some preservation steps are immediate: forensic imaging of the affected systems, collection of the logs before they expire and a search for signs that the attacker is still in the environment. IT fixes the environment; the examination ensures the fix does not erase the evidence of how the incident happened.
The notification asks for the category of the affected data, the number of data subjects, the security measures, the date and the cause of the incident (ANPD Resolution 15/2024, art. 6º, §2º). Each field is a fact to be demonstrated.
Where the access came in, which databases were read or copied, in what period and through which account. Scoping separates the data actually exposed from the data that merely sat on the same server, and defines the real size of the incident.
Data subjects are grouped by the data reached: identity and document data, financial and income data, authentication data, geolocation, photos and biometrics, family and dependants, purchase history. Children, adolescents and the elderly are counted separately, because the notification asks for that number.
The examination supports the completion of the notification within the three business days. Afterwards, the report compares what was declared with what was measured and supports the supplementary filing, allowed within twenty business days (ANPD Resolution 15/2024, art. 6º, §3º). Sensitive infrastructure details go into a separate annex, for the reasoned request for confidentiality (ANPD Resolution 15/2024, art. 7º). It is always the controller that notifies.
When the evidence shows that the incident does not meet the criteria of relevant risk or harm (ANPD Resolution 15/2024, art. 5º), the opinion documents why and becomes part of the record that the regulation requires to be kept for five years (ANPD Resolution 15/2024, art. 10).
When the incident hits an environment that changed hands, the first dispute is over responsibility: was the system inherited or already part of the new operation? In one real case, tens of terabytes were preserved before remediation precisely to separate one from the other. The same examination enters M&A due diligence, to find out whether the target company has already suffered an incident it did not declare.
Then come the ANPD's requests for information, the administrative proceeding and the data subjects' lawsuits. The processing agent is not held liable when it proves that it did not carry out the processing, that there was no breach of the law or that the harm results from the exclusive fault of the data subject or of a third party (LGPD, art. 43), and the judge may reverse the burden of proof in favour of the data subject (LGPD, art. 42, §2º). The examination produces that proof. It demonstrates, for example:
Lawsuits over improper data sharing through cookies, tags and third-party scripts are multiplying. The question is technical: what left the user's browser, where it went and whether the user consented.
The examination reads the code the website and the app actually execute, maps every event sent and the data that travel with it, and observes the traffic in the sign-up, login, purchase and cookie-refusal flows. That is where one sees whether consent governs the collection or is just a notice on the screen. The report reconstructs the configuration in force on the date of the facts and uses as its reference the guidance document "Cookies e Proteção de Dados Pessoais" (Cookies and Personal Data Protection), published by the ANPD in 2022. If the opposing party has filed a copy of the website, the examination verifies how it was made.
The same examination works before litigation. The preventive privacy audit shows what the website and the app send today, while there is still time to fix it.
Challenge. A company was sued on the allegation that its website shared users' personal data with third parties without consent.
Method. The technical opinion examined the scripts executed by the website, the data sent in each flow and the traffic with the live website, and audited the copy of the website filed by the plaintiff.
Outcome. The opinion showed there had been no violation. The case was closed without a court-ordered examination, and the client avoided a high-value judgment.
Challenge. A company needed to notify the ANPD of an incident involving data subjects on a large scale, and the figures from the first hours were estimates.
Method. The examination scoped the incident, separated the data subjects into exposure groups, identified the vulnerable ones and segregated the technical details into a confidential annex.
Outcome. The report compared what was declared with what was measured and grounded the supplementary notification.
An educational institution discovers that its enrolment database, with data on minor students and their guardians, was copied through unauthorised access. The three-business-day clock is already running, and nobody knows how many students were affected. The examination preserves the logs, scopes the period and the account used, counts children and adolescents separately and delivers first what the notification requires.
A hotel chain receives complaints from guests who paid, by message, a "booking confirmation" the hotel never sent. The scammers knew the name, dates and amount of each booking. The examination looks at the booking system, the integrations with third parties and employee access to find the source of the leak, even if it sits with a supplier.
See also
Corporate Investigations and Compliance → Digital Authorship and Subscriber Data Disclosure → Corporate and M&A → Insurance and Cyber Claims → Computer Forensics and Digital Investigation → Judicial and Extrajudicial Expert Work →
Before deciding, it is worth seeing what has already come through this laboratory: cases described without identifying the parties, in the format of challenge, method and result.
The intruder's control channel was written into smart contracts. The examination decoded what he had deleted and handed the authorities concrete routes to identification.
See the case Negative proofThe official examination had concluded that he took part. The re-examination showed the links were false positives, and the accused person was cleared.
See the case