To support companies in preventing and managing incidents involving personal data, IAB Brasil launched the “Personal Data Security Incident Guide”. The guide, which responds to a demand from various members, was developed by the Legal Affairs Working Group and also involved the participation and engagement of representatives from various companies. The material provides incident response guidelines, helping organizations comply with the requirements of the General Data Protection Law (LGPD) and strengthen their privacy governance.
Given the increasing digitization of businesses and the growing challenges related to information security, the guide details best practices for preventing and mitigating risks. The document clarifies the role of data processing agents – controllers, operators, and officers – and provides guidance on classifying incidents according to impact and risk level.
The guide also explains mandatory communication protocols, including notification to the National Data Protection Authority (ANPD) and data subjects in cases of high risk. IAB Brasil developed a step-by-step guide for properly reporting incidents within the three-business-day deadline, as required by current legislation.
“Information security is an essential pillar for building digital trust. We developed this guide to empower companies and professionals to respond appropriately and efficiently in case of security incidents, ensuring transparency and damage mitigation,” says Denise Porto Hruby, CEO of IAB Brasil.
Available for download on the IAB Brasil website, the material can be accessed here.
