Almeida e Trindade Advogados
Preparedness is also a legal matter.
When an organization identifies a security event, several teams may need to act at once. Technical teams work to understand and contain it; others gather information, assess consequences, and decide how to communicate. Defining responsibilities before an emergency helps organize the response.
Understand the event before classifying it.
ANPD guidance distinguishes security incidents generally from those involving personal data. Notification duties depend on the applicable criteria, including potential significant risk or harm to data subjects. The context and effects of the event are therefore central to the analysis.
Investigation may still be underway when action or notification becomes necessary. Deadline assessment should begin when the event is identified and evolve with the available information. Working records should distinguish confirmed facts, hypotheses under investigation, and unanswered questions. This helps prevent later communications from presenting unverified information as certain.
Responsibilities that need coordination.
A preparedness exercise can begin with questions: Who receives the first alert? Who gathers technical facts? Who knows the relevant supplier contracts? Who assesses legal obligations? Who is authorized to send the agreed communications?
These roles may be assigned to different people. Preparation should address how information reaches decision-makers, including when a supplier is involved. A contact list without clear responsibilities cannot provide that coordination on its own.
Record facts, decisions, and responsibilities.
A response record may include when the event became known, information received, measures taken, responsible persons, and the reasons behind notification decisions. It should be updated as the investigation progresses, maintaining the distinction between confirmed facts and hypotheses.
Technical response and legal assessment.
Technical containment and investigation produce important information for legal assessment. Legal work examines the relevant obligations, notification requirements, and documents needed. These functions complement each other and must respond to changes in what is known about the event.
After the immediate response, the decision history may suggest opportunities to review contracts and procedures. Deadlines and measures for a specific incident must be assessed against current rules and identified circumstances, with support from the responsible professionals.
Further reading.
For information only. Analysis of a specific situation depends on its facts, documents, and applicable rules.