Template id: breach-notice-anpd-br.v1 owner: Lilith-Privacy lead + BR
counsel deadline: 3 working days from knowledge of the incident (ANPD
Resolution CD/ANPD No. 15/2024) submission: ANPD's electronic breach
communication system, in Portuguese
Affected data subjects (titulares) are notified in the same window, in pt-BR, when the breach may create relevant risk or damage.
Required content (LGPD Art. 48 §1 and ANPD regulation)#
- Controller and encarregado (DPO): identification and contact, matching the pt-BR privacy policy controller block (legal-docs publication gate supplement).
- Description of the nature of the affected personal data.
- V3 data-class checklist: V1 account records / e-mail addresses / payment metadata / voice transcripts / recordings / consent-ledger entries / DSAR exports / Pixel Streaming session logs (IP addresses).
- Affected data subjects: approximate number of Brazil-resident users; flag children/adolescents separately (heightened LGPD treatment).
- Risk assessment: why the incident may (or may not) cause relevant risk or damage to data subjects.
- Technical and security measures used before and after the incident (encryption-at-rest state of the affected stores is material here).
- Timeline: occurrence, detection, knowledge (3-working-day clock anchor), and reasons for any delay.
- Measures taken or to be taken to reverse or mitigate the effects.
- Communication plan to data subjects: content, channel, and date.
Internal routing#
- Drafted by: Lilith-Privacy lead with BR counsel; the pt-BR user notice is produced by the localization owner from the counsel-approved Portuguese master, never machine-translated unreviewed.
- Evidence: submitted communication, ANPD protocol number, and timestamps in the incident evidence bucket, referenced from the Operator Console case.