LGPD and Personal Data Security in Brazil

Identify personal and sensitive personal data

ANPD explains personal data in relation to identified or identifiable natural persons. Sensitive personal data has a distinct legal category. Build the inventory around the record and its context rather than assuming that only a national identification number matters.

Sources: [1]

Review the process that creates copies

Choose a process such as customer onboarding or employee support. Identify original records, exports, recipients and the purpose of each copy. Ask the business owner whether information is still necessary and whether access matches the approved task.

Test Portuguese-language examples and realistic document combinations. Record ambiguous findings for human review rather than treating a keyword match as a legal classification decision.

Use the ANPD's incident criteria and timing

ANPD guidance addresses confirmed incidents involving LGPD personal data that may cause relevant risk or harm. It describes notification to ANPD and affected data subjects generally within three working days, subject to applicable qualifications and specific legislation. The controller is responsible for the communication decision; not every technical alert meets the criteria.

Sources: [2] [3]

Preserve a useful incident record

Document the information involved, affected processing activity, protections and assessment timeline. Restrict access to supporting records and avoid distributing full personal data in investigation messages. After containment, verify that the export or sharing workflow no longer recreates the same exposure.

Applying this with TRIAS

Evaluate TRIAS discovery and DLP against the approved personal-data categories and sharing scenarios. Confirm reviewer access and incident evidence handling. The controller's legal assessment, lawful processing decisions and ANPD notifications remain organisational responsibilities.

• Discovery and classification →
• Data loss prevention →