TerraLex Cross-Border Guide to Global Crisis Management Regulatory Guide

According to Law No. 13.709 of 2018 (Brazilian Data Protection Law), a personal data breach must be notified to the Brazilian Data Protection Authority (ANPD) when it involves personal data and is likely to result in relevant risk or damage to the data subjects.

This obligation arises from the principle of accountability and aims to ensure transparency and prompt action to mitigate potential harm.

The specific details regarding the notification process, including the content, deadlines, and procedures, are established by Resolution No. 15/2024, published by ANPD on April 24, 2024.

In addition, depending on the company's industry and the nature of the data involved, other authorities may require notification, such as the Consumer Protection Officer (PROCON), in situations affecting consumers, and the Central Bank of Brazil (BACEN), in incidents involving financial data and operations.

With regards to cybercrimes, the police should be notified whenever a cybercrime related to data protection occurs.

The primary legislation in Brazil concerning data protection and, consequently, data breach is the Brazilian Data Protection Law. The Brazilian Data Protection Law establishes the rules for the processing of personal data and provides for administrative sanctions for non-compliance, which can range from warnings to fines of up to 2% of the company's annual revenue, capped at BRL 50 million per violation.

Still in the civil sphere, Law No. 10.406 of 2002 (Civil Code) and Law No. 8.078 of 1990 (Consumer Defense Code) are applicable to support claims for material and moral damages suffered by data subjects.

In the criminal sphere, Decree-Law No. 2.848 of 1940 (Penal Code) contains provisions related to data breach, such as the crime of invasion of a computer device (Art. 154-A).

Search and seizure operations in private companies, commonly known as "dawn raids," can primarily be conducted by the Federal Police and Civil Police, always subject to prior judicial authorization, as established in Articles 240 to 250 of Decree-Law No. 3.689 of 1941 (Code of Criminal Procedure). The Federal Constitution, in Article 5, Clause XI, guarantees the inviolability of the domicile, allowing such measures only with a court order.

The Public Prosecutor’s Office may request the issuance of a search and seizure warrant and supervise its execution, pursuant to the Code of Criminal Procedure, as well as the Federal Constitution.

In the administrative sphere, the Administrative Council for Economic Defense (CADE) may carry out inspections in companies to investigate violations of economic order, subject to judicial authorization, according to Law No. 12.529 of 2011.

The Federal Revenue Service (Receita Federal) also conducts audits and seizures in administrative tax proceedings related to tax evasion and fraud, based on the National Tax Code and Decree No. 70.235 of 1972.

Meanwhile, the ANPD has the competence to carry out audits and request information to ensure compliance with the General Data Protection Law, applying administrative sanctions, but it does not have criminal seizure powers.

Thus, criminal search and seizure operations depend on a judicial order and are conducted by the Police and the Public Prosecutor’s Office, while administrative bodies such as CADE, Receita Federal, and ANPD have their own supervisory mechanisms and may resort to the Judiciary when necessary.

Once a judicial order has been issued, the company involved cannot refuse to permit the seizure of documents. However, that company may request that the competent judicial authority determines the confidentiality of any seized documents in case of attorney-client privilege, defect in the warrant regarding the judicial order, and financial, tax, or trade secrets.

The employee will be entitled to protection when reporting an alleged wrongdoing by the company or by another employee in all circumstances.

There is no specific protection for the reporting employee under current legislation. Law No. 12.846 of 2013, however, provides that where a company has in place a mechanism for reporting wrongdoings, that company may benefit from a reduced penalty in the event that corruption is discovered.

Most companies have anonymous hotlines for this purpose, which is considered a good practice for companies, according to the Brazilian Institute of Corporate Governance-IBGC Best Practices Code.

List: - Law number 12.846 of 2013.

• Law number 13.303 of 2016.

Yes, the purpose of Law number 12.846 of 2013 is to establish liability of any legal person – even foreign companies, which have their headquarters, branch or representation in the Brazilian territory, whether they are constituted in fact or under the law, even on a temporary basis – in relation to acts against the public, or the national or foreign administration.

Furthermore, several companies (especially those listed on the Stock Exchange Market) follow international anti-corruption laws, such as the FCPA – U.S. Foreign Corrupt Practices Act and the UK Bribery Act, which is well regarded by the market.

List: - the Federal Comptroller Office (“Controladoria Geral da União”), which is responsible for the defense of public assets and for the prevention of white collar crime and corruption (administrative proceeding); and

• the Public Attorney Offices.

Irregularities must be disclosed to a government authority in accordance with applicable legislation or the company’s code of conduct.

The documents generated as part of the private investigation will be deemed confidential and intended only to be used by the directors and officers of the company.

Yes. As a general policy, under the rules of the Brazilian Bar Association, lawyers are required to maintain professional secrecy about matters relating to their clients at all times.

The advice given by an in-house lawyer in relation to an investigation will be confidential and intended only to be used by the directors and officers of the company.