Brazil: Implemented ANPD Security Incident Reporting Regulation (Resolution No. 15)

On 26 April 2024, the National Data Protection Authority (ANPD)’s Security Incident Reporting Regulation (Resolution No. 15) entered into force. The regulation sets forth a framework for handling security incidents that have the potential to pose significant risks or cause harm to data subjects. Among its provisions, the regulation outlines specific criteria for reporting such incidents, establishes protocols for communication both to the ANPD and affected data subjects, and delineates procedures for thorough investigation, communication, and record-keeping. In particular, the regulation specifies that data controllers are required to notify the ANPD within 3 working days of security incidents.