Data Breach Response Plan: Who to Notify and When

A data breach response plan is the document that decides, before a crisis, who discovers, who decides, who notifies Brazil's ANPD, who speaks with the customer, and how quickly each step occurs. Without one, a company might discover an incident on a Friday night and spend the legal deadline debating who is responsible. This guide shows you how to build your plan, with real-world timelines, defined roles, and a checklist for the first 72 hours.

TL;DR

• In Brazil, Resolution CD/ANPD nº 15/2024 sets a deadline of 3 business days, counted from the knowledge of the incident, to notify the ANPD and data subjects when there is relevant risk or damage. Small entities have double this deadline.
• After notification, you have 20 business days to supplement the information. Every incident, whether communicated or not, must be recorded for a minimum of 5 years.
• The average cost of a data breach in Brazil reached R$ 7.19 million in 2025, according to IBM's Cost of a Data Breach report. LGPD fines are only part of that expense.
• A data breach response plan fits on a few pages: named roles, a 'notify or not notify' decision tree, ready-to-use text templates, and an hourly checklist.

What a Data Breach Response Plan Is (and Isn't)

It's an operational roadmap, not a privacy policy or a Data Protection Impact Assessment (DPIA). It answers in writing five questions that no one answers well with a racing heart:

1. Who can declare that an incident exists?
2. Who decides if it needs to be communicated to Brazil's ANPD and affected individuals?
3. Who executes technical containment (change passwords, isolate server, revoke token)?
4. Who writes and signs the communications?
5. Where is the evidence of everything done, and in what order?

Brazil's General Data Protection Law (LGPD, Art. 48) obliges the data controller to notify the authority and the data subject when an incident could generate relevant risk or damage. Resolution 15/2024 transformed this "reasonable deadline" from the law into an objective rule.

At Agathas Web, we manage Moodle servers, websites, APIs, and integrations with the official WhatsApp API for clients of various sizes. The pattern we observe is consistent: those with a three-page data breach response plan resolve issues in hours that others without one take days to resolve. The difference is almost never technical. It's about decision-making.

If you're still in the phase of understanding how breaches occur, start with our guide on what a data breach is and how to prevent it. This post begins where prevention has failed.

Timelines from Brazil's ANPD Resolution CD/ANPD nº 15/2024, Explained Simply

The resolution was approved in April 2024 and regulates the communication of security incidents. In September 2025, the ANPD was transformed into a regulatory agency by Provisional Measure 1.317/2025, and the communication procedure remained the same. The numbers that matter for those designing a data breach response plan are:

What	Deadline	Counted from
Notify Brazil's ANPD (incident with relevant risk or damage)	3 business days	Knowledge that the incident affected personal data
Notify affected data subjects	3 business days	Same milestone
Supplement communication made to Brazil's ANPD	20 business days	Date of communication
Small entity (Brazil's ANPD Resolution CD/ANPD nº 2/2022)	Double deadlines	Same milestones
Record keeping of incidents (including those not communicated)	Minimum of 5 years	Date of record

Three Details That Catch Companies Off Guard

The clock doesn't wait for the investigation to finish. It starts running as soon as the controller knows personal data has been affected. Investigating for a week before "declaring" the incident only creates a delay that needs justification.

Preliminary communication exists, but it doesn't solve everything on its own. According to the ANPD's official page on incidents, it is accepted when information is missing, provided it is justified and supplemented later. On its own, it does not comply with LGPD Art. 48.

The channel is Brazil's ANPD's SEI system. The Data Protection Officer (DPO) or legal representative files through electronic petitioning. If no one in the company has external user access to SEI, create it now, not on the day of the incident.

When an Incident Needs to Be Communicated

Brazil's ANPD considers three conditions simultaneously: the incident is confirmed, it involves personal data subject to the LGPD, and it could generate relevant risk or damage to data subjects. Factors for "relevant" include:

• Sensitive data (health, biometrics, religion) or data of children, adolescents, and the elderly;
• Large scale, by the quantity of data subjects and data;
• Absence of encryption that renders the data unintelligible;
• Low effectiveness of mitigation measures already applied.

A Decision Matrix That Fits on One Page

Communicating everything out of fear creates noise. Not communicating for convenience is a violation. The middle ground is a simple matrix that every data breach response plan should include, filled out by the DPO and attached to the record.

Situation	Tendency	Why
Lost laptop with encrypted disk and strong password	Record, do not communicate	Data unintelligible to third parties
Customer spreadsheet with name and email sent to the wrong recipient, who confirmed deletion	Record, evaluate	Low scale and proven containment
Moodle database with CPF (Brazil's individual taxpayer ID), grades, and accessibility reports copied by an intruder	Communicate	Sensitive data, scale, and confirmed copy
WhatsApp API token exposed in a public repository, with accessible conversation history	Communicate	Content of messages and customer phone numbers
Ransomware with confirmed exfiltration	Communicate	Data copy plus risk of disclosure

The table represents a tendency, not a definitive opinion. What the matrix ensures is that the decision was made with criteria and can be explained later, and it is this trail that regulators examine.

For those operating an EAD (distance learning) environment, there are particularities: data of minors, medical reports for exam accommodations, and grades. We detail this in LGPD in Moodle: What Institutions Need to Do in the LMS.

Who Notifies Whom: The Roles Map

The most common mistake is a plan that says "the company will notify the ANPD." Notification is done by an individual. Your data breach response plan needs to include names, personal phone numbers, and a backup for each role.

Role	Typical Holder	Primary Responsibility
Incident Coordinator	Partner, Director, or IT Manager	Declares the incident, convenes the team, decides priorities
Data Protection Officer (DPO)	Internal or outsourced	Assesses relevant risk, drafts and files communication with Brazil's ANPD
Technical Lead	Sysadmin, Hosting Provider, Responsible Developer	Containment, evidence preservation, root cause
Legal	In-house counsel or law firm	Reviews communications, contracts with processors, exposure to lawsuits
Communications	Marketing or Customer Service	Text to data subjects, responses to customers and press
Processors	Hosting, SaaS, Agency, Software Provider	Notify the controller and provide logs and information

Controller and Processor Do Not Have the Same Duty

The entity that decides on the data (the controller, usually your company) is responsible for notifying Brazil's ANPD and data subjects. The processor (the hosting provider, the CRM vendor, the agency running your website) has a duty to notify the controller and collaborate. In practice, this means that your 3-business-day deadline depends on the speed of your vendor.

Review your contracts: a clause requiring notification within 24 hours, with log delivery, saves your deadline. In the managed hosting contracts we operate, client notification is immediate, and logs are provided concurrently, because we know they are the ones who respond to Brazil's ANPD.

72-Hour Checklist

The 72 hours below are the core of any data breach response plan and fit within the 3 business days in most scenarios. If the incident starts on a Friday, you gain the weekend to investigate, but don't count on it to delay the decision.

Hour 0 to 4: Confirm and Contain

• Record the exact date and time someone became aware. This is the deadline's starting point.
• The coordinator declares the incident and opens a closed channel (dedicated group, not the general company group).
• The technical lead preserves evidence before cleaning up: server snapshot, copy of access logs, database, and firewall logs.
• Contain: change exposed passwords and keys, revoke API tokens, block IPs, isolate the compromised machine.
• Notify involved processors (hosting, SaaS) and formally request logs in writing.

Hour 4 to 24: Assess

• Which categories of data were affected? Is there sensitive, financial, or minor's data?
• How many data subjects? An estimated count with a method is better than an "we don't know".
• Were the data encrypted? Was the key also leaked?
• Was the access read-only, or was there copying, alteration, or deletion?
• The DPO fills out the risk matrix (see next section) and recommends: notify or record.

Hour 24 to 72: Decide and Communicate

• The coordinator and legal team validate the decision. If notification is required, the DPO files it in Brazil's ANPD's SEI system (preliminary, if data is missing).
• Communication to data subjects goes out through the usual channel (email, SMS, WhatsApp, student portal), in simple language.
• Customer service receives a response script and the DPO's contact information.
• Everything is entered into the incident log, including the decision not to communicate and why.

After 72 Hours

• Supplement communication to Brazil's ANPD within 20 business days.
• Root cause report and list of corrections with responsible party and date.
• Lessons learned meeting and plan update.

What to Tell Brazil's ANPD and Data Subjects

Communication to Brazil's ANPD follows the official form. Communication to the data subject is yours, and it defines the customer's reaction. Have both templates ready within the data breach response plan, reviewed by legal.

Minimum Content for Data Subjects

According to ANPD guidance, the text to the data subject should include, in simple language: nature and category of data, security measures that protected them, risks, reasons for any delay, mitigation measures, date of your knowledge, and DPO contact. It should be direct and individual whenever possible; a generic notice on the website or in the press is an exception and requires justification.

When NOT to Send the Notification Yet

Do not send emails to thousands of people before knowing if the intruder is still inside. If the transactional email account has been compromised, your notice becomes the attacker's phishing attempt. Contain first, communicate through a channel you control, and if this pushes the deadline, use preliminary communication and document the reason.

Two classic text errors: minimizing ("a small incident with no impact") before knowing the full extent, and asking the customer to click a link to "verify if they were affected," which is exactly a scam pattern.

The Cost of Not Having a Plan

IBM's Cost of a Data Breach 2025 report estimated the average cost of a breach in Brazil at R$ 7.19 million, a 6.5% increase over 2024. Healthcare leads, with an average of R$ 11.43 million. Third-party and supply chain compromise emerged as the most expensive vector, averaging R$ 8.98 million. The sample consists of organizations larger than the average SME, but the cost composition applies to all: forensics, legal counsel, customer service, and lost customers.

LGPD fines in Brazil can go up to 2% of revenue, limited to R$ 50 million per infraction (Art. 52). In addition, there are warnings, public disclosure of the infraction, and blocking or deletion of data. For many companies, public disclosure hurts more than the fine.

And incidents are routine. According to a survey based on ANPD panels, the average was around 350 incident communications per year between 2023 and 2025, with ransomware and credential theft among the most frequent types.

Without a plan, money is wasted on hastily contracted forensics, overly broad communication due to lack of assessment, and missed deadlines, which turns a well-handled incident into a sanctioning process.

Building and testing a data breach response plan costs a fraction of that. A well-scoped technology consulting service delivers the plan, templates, and the first simulation in a few weeks.

Technical Pitfalls We See in Practice

This is the part that an internet-downloaded data breach response plan template doesn't cover, because it depends on how your infrastructure truly operates.

Logs Nobody Keeps

A server with a 7-day log rotation and an incident discovered 20 days later: there's no way to prove what was accessed. Define minimum retention (90 days is a reasonable starting point for web and database access logs) and store them off the server that could be compromised. Without logs, no data breach response plan works.

Shared Credentials

"The panel password is in the WhatsApp group" is the phrase we hear most often when taking over an environment. With five people using the same login, no one knows who did what. Individual accounts with two-factor authentication are a prerequisite, not a future improvement.

Forgotten API Tokens

Integrations with the official WhatsApp API, payment gateways, and CRMs use long-lived tokens. A token in a public repository or an exposed .env file grants access to customer conversations and data. List where each token resides and how to revoke it in minutes.

Backup That Also Leaked

Backup in the same cloud account, with the same credential, falls together. And an .sql dump forgotten in the public folder of the website is a breach waiting to happen.

For the human side of the problem, uncontrolled AI usage has also become a data egress point. We address this in company AI usage policy.

How to Build Your Data Breach Response Plan in 4 Steps

You don't need a 60-page document. You need a document that someone can open at 11 PM and follow.

1. Minimum Inventory. Which systems process personal data, where they are hosted, who the vendor is, where logs and backups are kept. A spreadsheet works.
2. Roles and Contacts. The roles table above, with name, backup, personal phone number, and who has access to Brazil's ANPD's SEI system.
3. Procedures and Templates. The 72-hour checklist, the decision matrix, the data subject communication template, and the incident log template.
4. Test. A 2-hour tabletop exercise: someone describes a scenario, the team responds how they would handle it. The first time, a gap always appears, and it's better for it to appear in the simulation.

When It's Not Worth Complicating Things

If your company has an institutional website without forms and no systems with customer data, the data breach response plan can be a single page. Complexity should be proportional to risk. What doesn't exist is "I don't have personal data" for those who serve customers via WhatsApp, issue invoices, or maintain an email list.

How Agathas Web Solves This

Our technology consulting service builds your data breach response plan based on your company's real infrastructure, not a generic template. We are a technical team: we examine servers, logs, backups, tokens, and vendor contracts, and deliver the plan along with the corrections that make the plan executable.

What's Included:

• Infrastructure diagnosis: where personal data is located, who accesses it, log retention, backups, shared credentials, and exposed API tokens.
• Written plan with roles, contacts, 72-hour checklist, decision matrix, and communication templates for Brazil's ANPD and data subjects.
• Priority technical adjustments: off-server log retention, individual accounts with two-factor authentication, backup review, and scanning for exposed files.
• Tabletop exercise with your team and a report on what needs improvement.
• Support during a real incident, if it occurs: containment, evidence preservation, and technical data for the DPO and legal team.

How it works: an initial diagnostic conversation, a proposal with a fixed scope and timeline, and execution in short cycles. We do not replace your attorney or your DPO. We deliver the technical part they need to meet deadlines, and we review the data breach response plan whenever the infrastructure changes. To hire us, contact us through our technology and security consulting page.

Conclusion: The Plan Is for Your Worst Day, Write It on Your Best

Three business days seems like a lot until you need to discover, in the middle of an incident, who has the server password, where the log is, and who can sign the communication. A data breach response plan doesn't prevent an attack. It prevents the attack from also becoming a violation, a missed deadline, and a disastrous communication.

Start with the basics of your data breach response plan this week: name the coordinator and DPO, create access to Brazil's ANPD's SEI system, and find out how many days your logs are retained. If you want help turning this into a tested plan, Agathas Web's consulting service performs the diagnosis and delivers a ready-to-use plan.