Does the three-business-day clock start at detection or at confirmation?

Resolution CD/ANPD nº 15 frames the window from the controller's confirmation of the incident. Confirmation is a determination the controller makes, which means the triage process that turns an alert into a confirmed incident is itself part of the compliance record. Documenting when confirmation occurred, on what basis, and who made the call supports the timeline in the notification and answers the follow-up question about any delay.

Is every AI-related incident notifiable to the ANPD?

No. The three cumulative conditions must all hold: confirmed occurrence, personal data protected by the LGPD, and relevant risk or damage to data subjects. An incident involving no personal data, or one where effective encryption and prompt mitigation remove the relevant risk, may not meet the threshold. The assessment itself should be documented either way, because a decision not to notify is a decision a supervisor may later review.

What if the data categories cannot be determined within three business days?

The communication to data subjects explicitly allows for reasons for delay to be stated, and the notification asks for the risks identified rather than a certified final list. A controller in that position should notify with what is established, record the basis for the uncertainty, and supplement as the investigation progresses. A gap in prompt classification that recurs across incidents becomes a finding about the control environment itself.

Where does DeepInspect fit in LGPD incident reporting?

DeepInspect evaluates HTTP traffic between authenticated users or agents and LLM endpoints routed through it, and writes a per-decision record carrying identity, content classification, model destination, policy version and outcome. That record supports the data categories and recipients fields of an ANPD notification. Intrusion into internal systems, endpoint compromise, and the incident triage process itself are outside that boundary.

Brazil LGPD AI Incident Reporting: Three Business Days and What You Must Name

Brazilian controllers have three business days from confirming a security incident to notify both the ANPD and the affected data subjects. That deadline comes from Resolution CD/ANPD nº 15, dated April 24, 2024, and it applies to an incident involving an LLM exactly as it applies to a stolen laptop.

The difficulty is that the notification form asks questions an AI deployment is usually unprepared to answer inside three business days.

TL;DR

ANPD Resolution CD/ANPD nº 15 of April 24, 2024 sets a three-business-day window from confirmation to notify the ANPD and affected data subjects.
Notification is required only when the incident is confirmed, involves personal data, and poses relevant risk or damage.
The ANPD notification must carry the incident description, affected data categories, security measures, identified risks, mitigation actions, discovery date, and a contact.
Communication to data subjects must use simple language and cover the compromised data, possible impacts, remedial action, the incident date, and a contact.
For an LLM incident the hard fields are data categories and likely impact, because prompt content is rarely classified before it is sent.

The three conditions that trigger notification

The ANPD's incident guidance applies a cumulative test. The controller must have confirmed the occurrence. The incident must involve personal data protected by the LGPD, whose Article 48 carries the duty to communicate. It must pose relevant risk or damage to data subjects.

Risk assessment considers the context of the activity, the number of affected individuals, the types and volume of data, the potential for material, moral or reputational harm, whether the data was encrypted, and how effective mitigation was. The ANPD notes that large-scale incidents involving sensitive data belonging to vulnerable groups, including children and the elderly, typically qualify as relevant risk.

Applied to an AI deployment, the middle condition is where most teams stall. Establishing that personal data was involved requires knowing what was in the prompt, and the classification of prompt content is the field almost nobody retains.

What the notification actually asks for

The submission to the ANPD carries the incident description, the categories of affected data, the security measures employed, the identified risks, the mitigation actions taken, the date the incident was discovered, and contact details for follow-up.

The communication to data subjects is a separate document written in simple language. It covers the nature of the compromised data, the protective measures in use, the possible impacts, the reasons for any delay, the remedial actions, the incident date, and a contact.

Read those two lists against an LLM incident. The date is available from platform telemetry. The security measures and mitigation actions are describable from the control environment. The categories of affected data and the possible impacts depend entirely on knowing what content crossed the boundary, and an inference log that records token counts and model identifiers answers neither.

Why an AI incident is harder to characterise in three days

A conventional breach has a bounded artefact. A database was reached, a table has known columns, and the categories follow from the schema.

Prompt traffic has no schema. An employee pastes a section of a contract, a support agent pastes a customer message, an agent assembles context from four systems and sends it in one request. Reconstructing what was in those requests after the fact means reading the payloads, and payload retention is either absent or governed by a policy that deletes it faster than the investigation runs.

The second problem is attribution. When an agent made the call, the provider saw only a service credential. Establishing which internal identity's work produced the request is the difference between naming affected data subjects and estimating them. Our AI agent identity material covers what that requires structurally.

The Spanish data protection authority logged its first breach notification naming an AI agent as the actor in September 2026, and the reconstruction problem it describes is the same one an ANPD notification runs into.

The records that make a three-day answer possible

Four fields, captured at the moment of the request, turn a three-day scramble into a query.

The authorising identity, meaning the person or scoped service principal whose work produced the call, rather than the credential the process happened to hold.

The content classification assigned to the request before it was sent, which is what converts "a prompt was sent" into "personal data of category X was disclosed".

The model destination and the processor behind it, since the notification asks about the recipients of the data.

The policy version in force and the decision outcome, which supports the security measures and mitigation sections of the form.

None of those four come from platform telemetry by default. They come from a decision point that evaluates the request before it leaves, and writes the result somewhere the compromised system does not control. The AI audit log schema work sets out what that record looks like in practice.

Preparing the notification before you need it

Run the exercise with a real deployment and a hypothetical. Pick one production AI integration, assume it disclosed personal data on a Tuesday, and fill in the ANPD form from what you hold today. Note every field you had to estimate.

In most organisations the exercise stops at the data categories line within about twenty minutes, which is a cheaper way to discover the gap than discovering it during an actual incident with the clock running.

Then write the AI-specific scenarios into the register properly. Our LGPD AI compliance checklist covers the wider control set, and the controls mapping piece places incident response alongside the other LGPD obligations.

DeepInspect

DeepInspect provides an independent policy decision at the HTTP AI request boundary. For traffic routed through it, DeepInspect evaluates the application-supplied identity and role against organisational policy for content classification and model authorisation before the request reaches the model.

Each decision produces a signed, tamper-evident record held outside the calling application's write path. When the ANPD form asks which categories of personal data were affected and which recipients received them, that record answers from what was evaluated at the time rather than from a reconstruction attempted under a three-day deadline.

Book a technical deep dive at deepinspect.ai.