Data leaked in Brazil? What to do, step by step, under the LGPD

Your data leaked in Brazil? Step by step: passwords, bank, Registrato, police report, the 3-business-day LGPD notice rule and how to complain to the ANPD.

2026-10-31

If you learn your personal data was exposed in Brazil, the leak itself is rarely the main danger. What follows is: sharper scams, account takeover, and accounts, phone lines or loans opened in your name. This guide sums up the steps recommended by CERT.br, what the company must do under the LGPD, and how to complain to the ANPD.

What must the company tell me?

Under ANPD Resolution No. 15 of April 24, 2024, controllers must notify the ANPD and affected people within three business days of learning that personal data was affected, when the incident may significantly harm data subjects and involves financial, authentication or sensitive data, data of children or older adults, data under legal secrecy, or large-scale processing, according to Mayer Brown. The notice must describe the data, risks, measures taken and a contact, including the DPO.

Not every incident must be reported, but controllers must keep a record of all security incidents for at least five years, including those they did not notify. Small-scale processing agents follow differentiated rules.

Why do scams rise after a leak?

With a name, CPF (taxpayer ID), phone number and even purchase history, fraudsters can build a credible pitch: the "bank call center" that knows your address, the "store" citing your last order, the "relative" with a new number. CERT.br advises not clicking links in emails or texts, however convincing, confirming the recipient before any transfer, and reporting fake profiles in your name while warning your contacts.

What should I do right away?

Step	Action (per CERT.br)
1	Confirm the leak through official channels only
2	Change exposed or reused passwords
3	Turn on two-step verification
4	Tell your bank if card or account data leaked; block cards
5	Check the Central Bank's Registrato (accounts, loans, Pix keys) and the prepaid-line registry under your CPF
6	File a police report if you lost money, are extorted or impersonated

CERT.br also warns against buying leaked data or using sites that claim to "check" leaks, which are often traps.

How can I check whether someone used my CPF?

CERT.br recommends periodic checks: the Banco Central's Registrato, which lists bank accounts, loans and Pix keys tied to your CPF; the prepaid mobile registry (Cadastro Pré-Pago), which shows lines activated in your name; and your credit score, since a sudden drop may signal identity theft. Turn on transaction alerts for accounts and cards in your banking app, and review access logs for email, social media and banking, reporting any login you do not recognize.

How do I complain to the ANPD?

First send a formal request to the company and keep the protocol. If it is not met, petition the ANPD under LGPD art. 55-J, V, with proof of that request, via SEI or the gov.br LGPD service. The ANPD says it usually reviews petitions in aggregate and may not act on each case, but complaints shape its inspection priorities.

What to do: stay alert to links and calls that cite your real data, enable passkeys, and monitor your CPF regularly.

More: Brazil regulation, incident radar, what the ANPD enforces, Brazil’s biggest data breaches.