What a data breach is
Photo: Avila Ops Tecnologia
A data breach is any situation where personal information leaves its custodian’s control and reaches unauthorized people. No hacker required. Public-link spreadsheets, unlocked lost phones, emails to wrong lists, former employees taking contacts. Brazil’s LGPD, Law 13.709/2018, calls this a security incident.
Small-business breaches are usually mundane and cheap to prevent. Later costs are high: scams using your store name, damaged reputation, legal duties to notify ANPD and data subjects when significant risk or harm exists.
How do small-business breaches happen?
Our assessments find repeated causes:
- Reused passwords compromise business email when unrelated websites are attacked.
- Customer Drive spreadsheets shared with “anyone with the link.”
- Business WhatsApp on salespeople’s personal phones without screen locks.
- Website backups on USB drives in drawers.
- Phishing: fake “bank” emails stealing manager passwords.
- Outdated websites with known vulnerabilities.
What counts as a breach, and what does not?
Unauthorized access or exposure long enough for it counts. Public spreadsheets for three months should be treated as breached even without known access because you cannot prove otherwise.
Sharing for legitimate reasons is not a breach: carriers receive addresses, accountants receive payroll. Processing by operators is legally provided when contracts or clear agreements exist.
An optician emailing promotions with 300 customers visibly copied exposes everyone to everyone. A small breach, but still a breach. Use blind copies or sending platforms.
What to do now
Close these gaps this week: unique managed passwords, email two-step verification, restricted Drive links, phone locks, updated websites. For incidents, see breaches: first 24-hour actions. Assess exposure in one conversation: avilaops.com/contato or contact us on WhatsApp: wa.me/5517997811471.
Frequently asked questions
Must small breaches be reported to ANPD?
Law requires reporting incidents potentially causing significant risk or harm. Emails exposing 300 addresses usually fall below that, but record internally. Passwords, bank, health, children’s data are ANPD criteria (Resolution CD/ANPD 15/2024): report if significant impact is possible.
Is a stolen company phone a breach?
If unlocked or WhatsApp open, yes. Screen locks and remote erasure reduce risk greatly. Configure today.
Who answers for breaches caused by platforms I use?
Platforms answer as processors, but your company as controller answers to customers. Supplier contracts matter. See What personal data is in practice.
Turn what you learned into your next step.
Tell us about your company and what you want to improve. We can explore the right tools, integrations or custom project together.