Brazil’s national data protection law (LGPD) determines that the communication of the security incident must be made within a reasonable time (standard to be defined by the ANPD).

Under the law, the communication must demonstrate transparency and good faith and this will be considered in any inspection.

After becoming aware of an adverse event, and in the event of a relevant risk, the ANPD should be notified as soon as possible (standard to be defined by the ANPD).