Loading…
Sources: European Data Protection Board, members and European Commission, adequacy decisions, checked 2026-09-17.
Who has to be told and how long you have, from the regimes that reach Brazil. Each row keeps the article it comes from, so it can be checked rather than believed. Whether a regime reaches a particular company is a question for someone who knows it.
| Who | Within | When it starts |
|---|---|---|
| Autoridade Nacional de Proteção de Dados (ANPD) | 3 business days from learning of it | Security incident that may bring relevant risk or harm to the people whose data is involved |
| The people affected | 3 business days from learning of it | The same incident — Brazil sets one clock for both, where most regimes give the authority less time than the people |
| Who | How long | When it applies | Where it says so |
|---|---|---|---|
| Autoridade Nacional de Proteção de Dados (ANPD) | 3 business days from learning of it | Security incident that may bring relevant risk or harm to the people whose data is involved | LGPD, art. 48; Resolução CD/ANPD nº 15/2024, art. 6º |
| The people affected | 3 business days from learning of it | The same incident — Brazil sets one clock for both, where most regimes give the authority less time than the people | LGPD, art. 48; Resolução CD/ANPD nº 15/2024, art. 9º |
The regimes that apply here and the guides that answer what this page raises, worked out from what we have written.