Brazil’s ANPD Updates 40 Glossary Terms on Incidents, DPOs and Data Transfers: Why the Definitions Matter

Brazil’s data protection authority has quietly done something that will save compliance teams a lot of guesswork. The Autoridade Nacional de Proteção de Dados (ANPD) has finished updating 40 entries in its official glossary, adding terms drawn from three regulations it adopted in 2024: the Security Incident Reporting Regulation, the Regulation on the role of the data protection officer (the “encarregado”), and the International Data Transfer Regulation with its standard contractual clauses. The ANPD said in its announcement that the regulations made the update necessary, and that the review was led by its General Coordination for Standards (Coordenação-Geral de Normatização).

A glossary is not binding law. Each entry, though, points back to the article of the regulation it comes from, and it shows how the authority itself reads its rules. For companies that operate in Brazil, or move Brazilian data abroad, the glossary is now the quickest place to check what the ANPD means by terms that decide whether a duty applies.

Which terms were added or updated

Based on our review of the published glossary (in Portuguese, translated here), the new and updated entries cluster around the three regulations.

Security incidents (Resolution CD/ANPD No. 15 of April 27, 2024)

• Security incident that may cause relevant risk or damage (“Incidente de Segurança que Possa Acarretar Risco ou Dano Relevante”), the trigger for notifying the ANPD and data subjects. The entry lists the data types that, alongside a significant effect on people’s interests and rights, make an incident reportable, including sensitive data, financial data, and data protected by legal, judicial or professional secrecy.
• Large-scale data incident (“Incidente com Dados em Larga Escala”), defined as one covering a significant number of data subjects, considering also the volume of data and the duration, frequency and geographic spread of the people affected.
• Procedural terms such as the incident communication process, the incident handling report (“Relatório de Tratamento de Incidente”) and broad publicity of an incident in the media.

The data protection officer (Resolution CD/ANPD No. 18 of July 16, 2024)

• Formal act of appointing the encarregado, defined as a written, dated and signed document that clearly shows the organization’s intent to appoint a person or a company as its DPO.
• Conflict of interest in the encarregado’s role, defined as a situation that could improperly compromise, influence or affect the DPO’s objectivity and technical judgment.

International transfers (Resolution CD/ANPD No. 19 of August 23, 2024)

• Exporter and importer. The exporter is the processing agent, in Brazil or abroad, that transfers personal data. The importer is the agent in a foreign country, or an international organization, that receives it.
• Onward transfer (“Transferência Posterior”), an international transfer from an importer to a third party, including a subcontractor, other than an access request.
• Equivalent standard contractual clauses, clauses from other countries or international bodies that the ANPD recognizes as equivalent to its own model clauses in Annex II of Resolution 19.
• Roles inside the clauses, such as the designated party, the third-party controller and the subcontractor.

Why definitions matter more than they look

Each of these terms decides whether an obligation applies. Three examples show how.

1. Incident notification. Under Resolution 15, a controller must notify the ANPD and affected people of an incident that may cause relevant risk or damage, generally within three business days of learning it affected personal data. Whether an incident is reportable depends on the definition. A team that reads “relevant” narrowly may miss a deadline.
2. DPO appointment. Resolution 18 requires the DPO appointment to be made by a formal act. If your appointment is an email or a line in a policy, the glossary’s definition, a written, dated and signed document, tells you what the ANPD expects to see. Our guides to requirements for a Brazilian DPO and LGPD DPO rules cover the full duties.
3. Transfer contracts. Resolution 19 gave organizations until August 2025 to move existing contracts onto the ANPD’s model clauses. Knowing who is the exporter and who is the importer, and whether a vendor’s sub-processor counts as an onward transfer, determines which clauses apply. Our article on LGPD data transfers explains the available mechanisms.

A practical review for LGPD programs

• Align your incident playbook. Check that your internal criteria for a reportable incident use the ANPD’s terms and list the same data types. Add a step to assess whether an incident is large-scale under the glossary’s factors.
• Find the DPO appointment document. Confirm it is written, dated and signed, and that the DPO’s other duties do not create a conflict of interest as the glossary defines it.
• Map transfer roles. For each international flow, record the exporter, importer, any onward transfers and the clauses used. If you rely on another country’s clauses, check whether the ANPD has recognized them as equivalent.
• Update training material. If your staff guidance uses its own definitions, replace them with the ANPD’s wording and cite the glossary.

Companies moving data between Brazil and Europe should also watch the mutual adequacy process, covered in our piece on Brazil-EU mutual adequacy. For a broader check, our LGPD compliance checklist walks through the main duties, and our guide to LGPD data subject rights covers the requests you must answer.

Where Captain Compliance fits

Captain Compliance’s data mapping and records tools help teams record where Brazilian personal data goes, who receives it and under which transfer mechanism, and its data subject request portal helps receive and track LGPD requests. Those records make it easier to apply the ANPD’s definitions to your real data flows. They do not decide for you whether an incident is reportable or whether a contract meets Resolution 19.

Frequently asked questions

Is the ANPD glossary legally binding?

No. The binding text is the LGPD and the ANPD’s regulations. The glossary explains how the ANPD understands the terms and cites the provisions they come from.

How many entries did the ANPD update?

The ANPD says it finished updating 40 entries, adding terms from its incident reporting, DPO and international transfer regulations.

How fast must a security incident be reported in Brazil?

Under Resolution CD/ANPD No. 15/2024, a reportable incident must generally be communicated to the ANPD and affected data subjects within three business days of the controller learning that it affected personal data, with some extensions for small processing agents.

Does every company need a DPO under the LGPD?

Controllers generally must appoint one, though Resolution 18 and the ANPD’s small business rules provide exceptions. Where a DPO is required, the appointment must be made by a formal act.

Where can I find the glossary?

It is published on the ANPD’s website, in Portuguese, under its educational materials and publications.

Small document, real consequences

Regulators rarely announce a glossary update with fanfare, and most compliance teams will never read all 40 entries. The ones that do will notice that the ANPD has now written down, in its own words, the line between an incident you log and an incident you report, and between a DPO you named and a DPO you appointed. When the ANPD’s next enforcement decision turns on one of those lines, the company will not be able to say the definition was unclear.