What is a personal data security incident?

Definition

A security incident involving personal data is any adverse event, confirmed or suspected, related to a breach of the confidentiality, integrity, availability, or authenticity of personal data.

Data leaks, unauthorized access, ransomware, emails sent to the wrong recipient, loss of equipment, and accidental deletion of databases are all incidents. Not every incident needs to be reported to the ANPD (Brazilian National Data Protection Authority), but every incident needs to be recorded and evaluated.

What does the LGPD say?

Article 48 of LGPD This obligates the controller to notify the ANPD (National Data Protection Authority) and the data subject of any incident that may pose a significant risk or harm, specifying the nature of the data, the data subjects involved, the security measures, the risks, and the actions taken. Resolution CD/ANPD No. 15/2024, available at [link to resolution]. ANPD websiteIt establishes a deadline of 3 business days from the moment the incident is reported, defines the criteria for relevant risk, and requires the registration of all incidents for at least 5 years.

In practice

• Have a response plan with defined roles, channels, and deadlines.
• Assess the risk in each case: sensitive data, volume, vulnerabilities, potential for harm.
• Notify the ANPD within 3 business days when there is a significant risk, and notify the data subjects directly through a designated channel.
• Document the incident, analysis, and actions taken, even when there is no communication.

How Privacy Tools it deals with the topic

A Incident Management It registers the case, identifies the data and data subjects affected, assesses the risk using ANPD criteria, conducts the action plan, and produces the communication to the authority and the data subjects, with an audit trail.

Related terms

Sensitive personal data · ANPD · Controller · Operator · Back to glossary

Updated October 3th, 2026.