How should a Brazilian clinic handle LGPD and a data incident?

Health data is sensitive personal data under the LGPD, processed with the patient's specific and highlighted consent or, without it, where it is indispensable for health protection by health professionals, health services or a sanitary authority. An incident that may cause relevant risk or harm goes to the ANPD and to the patients affected within three working days of the clinic learning of it, under Resolução CD/ANPD 15/2024.

What the LGPD asks of a clinic

The LGPD treats data on health as sensitive personal data, and allows it to be processed with the patient's specific, highlighted consent for specific purposes, or without consent where it is indispensable, among other cases, to meet a legal or regulatory duty, or to protect health in a procedure carried out by health professionals, health services or a sanitary authority.¹ Patients have the right to confirm processing, see their data, correct it and receive it, and the controller names an encarregado whose identity and contact are published, preferably on its website.¹ Every processing agent must adopt technical and administrative security measures against unauthorised access and accidental or unlawful loss or change.¹

When an incident happens

The controller tells the ANPD and the patients affected about any security incident that may cause them relevant risk or harm.¹ Resolução CD/ANPD 15/2024 sets three working days for both, counted from when the controller learns that the incident affected personal data, and lists what each communication contains, including the nature of the data, the number of people affected, the measures taken and the risks.² The controller keeps a record of every incident, including those not reported, for at least five years.² The ANPD may fine up to 2% of the company's revenue in Brazil in its last financial year, capped at R$50 million per infraction.¹

1. Contain it. Stop the access, change credentials, keep the evidence.
2. Scope it from the logs. Which records, which patients, which accounts, and when.
3. Assess the risk. Decide whether it may cause patients relevant risk or harm.
4. Notify within three working days. To the ANPD and to the patients affected, with what Resolução 15/2024 lists.
5. Record it either way. Log the incident and the decision, and keep the record at least five years.
6. Fix the cause. Corrective measures, an owner and a date, reviewed by the encarregado.

1. Date learned ______ By ______
2. What happened ______
3. Data and patients affected ______
4. Risk assessment ______
5. ANPD notified on ______ Patients notified on ______
6. Reason if not notified ______
7. Corrective measures, owner and date ______

Copy template

Confidentiality is also an ethical duty

The Código de Ética Médica bars a doctor from letting people not bound by professional secrecy handle or see records under their responsibility, and from releasing copies except under a court order, in their own defence or with the patient's written authorisation.³

Questions

Does a clinic need patient consent to process health data?

Not always. The LGPD allows processing without consent where it is indispensable for health protection by health professionals or services, among other cases. Confirm the basis for each use with your counsel.

How fast must a clinic report a data incident?

Within three working days of learning the incident affected personal data, to the ANPD and to the patients affected, where it may cause relevant risk or harm.

How long do we keep the incident record?

At least five years from the date of the record, including incidents that were not reported.

Sources

1. 1Presidência da República, Planalto, 2018Lei nº 13.709, de 14 de agosto de 2018, Lei Geral de Proteção de Dados Pessoais (LGPD)Read source
2. 2Diário Oficial da União, 2024Resolução CD/ANPD nº 15, de 24 de abril de 2024, Regulamento de Comunicação de Incidente de SegurançaRead source
3. 3Conselho Federal de Medicina, 2018Resolução CFM nº 2.217/2018, Código de Ética MédicaRead source

Written by the wai team from ANVISA and the vigilância sanitária, the Conselho Federal de Medicina and the CRMs, and the Organização Nacional de Acreditação guidance, checked on 16 October 2026. This is guidance, not legal advice. Neither ANVISA, the CFM nor ONA endorses wai or any software.