In recent years, the Brazilian Central Bank ("BACEN") has demonstrated efforts to regulate personal data protection, privacy, and cybersecurity in the Brazilian financial sector. Accordingly to such actions and aiming for broad transparency - a guiding principle of data protection, last Tuesday (9.26.2023), BACEN published Resolution BCB No. 342, which enhances and tightens the rules regarding security incidents involving Pix-related data.

For reference, Pix is a Brazilian Instant Payment scheme created by BACEN that enables its users to send or receive payments/ transfer money in few seconds at any time, including non-business days.

Among the changes, it is worth mentioning the obligation for financial institutions to communicate their clients in case of data breaches involving personal data related to Pix, even if they are not responsible for the incident and the security incident may not pose a significant risk or harm to the data subjects.

It is important to highlight that, by establishing the need to notify any data breaches related to Pix, BACEN goes beyond what is set forth in the Brazilian General Data Protection Law ("LGPD"). For reference, LGPD only requires communication in the event of security incidents that could result in significant risk or harm to data subjects.

The Resolution also provides specificities regarding potential penalties, establishing, in the event of security breaches, more severe penalties for cases of greater impact, based on their effects and repercussions. It also defines a weighting factor for calculating fines in cases of security incidents involving personal data related to Pix, which will take into account the number of potentially affected Pix keys.

We will continue to follow up this matter and hope to bring new information soon regarding the development of data protection issues in Brazil.