It sets when and how to report a personal data security incident that may cause significant risk or harm to the ANPD and affected individuals, and requires an incident log.
Who it applies to
Controllers subject to the LGPD.
Penalties
Those under the LGPD (art. 52).
Official name
Resolução CD/ANPD nº 15, de 24 de abril de 2024 – Regulamento de Comunicação de Incidente de Segurança
Verified in the official source on November 4, 2026
Report significant incidents to the ANPD and individuals
Res. CD/ANPD 15/2024, arts. 6, 9 y 10In force
Already applicable
When it relates
If you process personal data subject to the LGPD.
What the rule provides
Report incidents that may cause significant risk or harm to the ANPD and individuals within 3 business days of learning they affected personal data; small processing agents get twice as long.
Keep a log of all incidents and retain it for at least 5 years.
Include AI system incidents (prompt-based leaks, training data exposure).
Verified in the official source on November 4, 2026Checked against the resolution text published by the ANPD on gov.br (SEI file 00261.000098/2021-67): arts. 6 and 9 ("three business days"), 9 § 6 (double deadline for small agents) and 10 (records kept at least five years). The DOU did not respond in this review.