Security · · Davi Netto
How to handle a personal data leak in your company
What Brazil's data protection law (LGPD) requires of your company when personal data leaks, and what fines and penalties it may face.
Often, when a leak happens, we find out about it from the media.
The controller (the entity responsible for processing the data) must notify the data subject and the national authority of any incident that may cause significant risk or harm to the people the information belongs to.
What fines and penalties can my company face in the event of a data leak?
Again, any fine will vary according to how sensitive the data is, the amount of data leaked, the measures the company took, and other factors. Some of the penalties set out in the law are:
- Blocking of the leaked personal data until the company remedies the situation;
- Deletion of the leaked personal data;
- Warnings with deadlines for correction;
- A fine of up to 2% of the private company’s revenue, capped at 50 million reais per violation;
- A daily fine within the limits above;
- Public disclosure of the violation, once it has been investigated and addressed.
