LGPD Art. 46: How Pentest Becomes Evidence of Security Measures for the ANPD

Category: LGPD Compliance | Pentest | Data Security Level: Intermediate Environment: Controlled laboratory — fully anonymized scenario, no real client data

---

Introduction

The LGPD (Law 13.709/2018) does not require a closed security standard — it requires security, technical and administrative measures capable of protecting personal data. This open wording of Art. 46 is, at the same time, the law's biggest opportunity and biggest trap for Brazilian companies: how do you prove, before an ANPD inquiry or a client demanding guarantees, that your measures are "capable"?

In practice, the answer that the authority and the market accept has a very specific format: reproducible technical evidence that the controls were tested. And that is exactly what a pentest — performed with methodology, defined scope and a structured report — produces.

This material is preventive and describes, in an anonymized laboratory scenario, how a telemedicine company turned the result of a penetration test into a compliance dossier in response to an ANPD inquiry — and what any organization can copy from that flow.

---

1. What Art. 46 requires (and what it does NOT require)

The text of the caput is short and deliberately open:

"Processing agents must adopt security, technical and administrative measures capable of protecting personal data from unauthorized access and from accidental or unlawful situations of destruction, loss, alteration, communication or any form of inadequate or unlawful processing."

Three practical readings of this provision:

1. "Capable" is the keyword. The law does not define firewall X or encryption Y. The ANPD assesses whether the measures are proportional to the risk — company size, volume and sensitivity of the data processed. What is adequate for a stationery shop is not adequate for a telemedicine platform.
2. It covers unauthorized access AND incidents. It is not only about "not letting attackers in". It is also about detecting, containing and notifying when something goes wrong — hence the direct link to Art. 48 (communication to the ANPD and to data subjects in case of an incident).
3. Accountability (Art. 6, X) requires demonstrating effectiveness. Does the measure exist on paper? Does it actually work? Under the principle of accountability, the controller must be able to demonstrate that it adopted and evaluated the measures — which, in practice, means testing periodically and documenting the result. Art. 46, §1, in turn, authorizes the ANPD to set minimum technical security standards — which reinforces the importance of having standardized technical evidence.

And that is where the pentest gains the status of evidence: a penetration test is, literally, a documented evaluation of the effectiveness of security controls.

What the ANPD has already published on the topic

The ANPD published the Orientative Guide for Small-Scale Processing Agents (2021), accompanied by a security measures checklist — the authority's most concrete document on what it expects to see day to day: access control, vulnerability management, security testing, monitoring and incident response. The guide does not invent requirements — it organizes what Art. 46 already requires. And vulnerability management with periodic testing is explicitly among the expected measures.

---

2. The laboratory scenario: the "VitaCare" clinic

To show the complete flow, we used a fictitious laboratory scenario: VitaCare, a telemedicine platform with 60,000 active patients, processing electronic health records, prescriptions and health data — that is, sensitive data under the definition of Art. 5, II of the LGPD (health data), subject to reinforced protection.

VitaCare received an ANPD inquiry stemming from a data subject petition (Art. 18, §1 — petition before the national authority). Deadline to respond: 15 days. The board asked the DPO for a dossier answering two questions:

1. Which security measures does the company adopt (Art. 46 caput)?
2. How do we know they work (accountability — Art. 6, X)?

The DPO hired a penetration test with web + API + infrastructure scope, with the following guidance: each finding must be mapped to an LGPD article and to the corresponding control of the management framework (ISO/IEC 27001:2022 as reference). The result: seven findings, all with reproduction, all with legal mapping.

---

3. The findings and the legal mapping

Finding 1 — [CRITICAL] Unauthorized access to other patients' health records (IDOR/BOLA)

In the health records API, the patient identifier came from the URL (/api/v1/records/1042), and authorization only checked whether the user was authenticated — not whether the record belonged to them. Any logged-in professional could read any patient's records by changing a number in the URL.

• Why the scanner did not see it: the flaw is in business logic (object-level authorization), invisible to automated scans that do not know the application flow. Only a manual test, driven by adversarial reasoning, finds this pattern.
• LGPD impact: mass unauthorized access to sensitive health data — the exact core of the Art. 46 caput. Exposure of health PII raises regulatory risk and harm to the data subject.
• Mapping: Art. 46 caput (unauthorized access); Art. 6, caput (good faith) and VII (security); ISO 27001:2022 Annex A 5.15 (access control) and 8.2 (access rights).

Finding 2 — [HIGH] Sensitive data without encryption at rest in the database

The records were stored in plain text in the production database, including the diagnosis field. Encryption existed only in transit (TLS).

• LGPD impact: Art. 46 does not list "encryption" as an obligation — but the ANPD expects protection at rest proportional to sensitivity. For health data, the absence of encryption at rest is hard to justify as a "capable" measure.
• Mapping: Art. 46 caput; ISO 27001:2022 Annex A 8.24 (encryption) and 8.12 (data leakage prevention).

Finding 3 — [HIGH] No traceability: missing access logs

The application did not record who accessed which health record, or when. Access auditing was impossible.

• LGPD impact: without operation logs, the controller cannot (a) detect unauthorized access, (b) size an incident for the Art. 48 notification, or (c) answer the data subject's petition with evidence. Traceability is a prerequisite for demonstrating the effectiveness of measures (accountability, Art. 6, X).
• Mapping: Art. 6, X (accountability — demonstrate effectiveness of measures); ISO 27001:2022 Annex A 8.15 (logging) and 8.16 (monitoring); Art. 37 (record of processing operations, as support).

Finding 4 — [MEDIUM] Backups outside the retention policy

14-month-old backups were kept indefinitely, including accounts of patients inactive for years.

• LGPD impact: retention beyond what is necessary conflicts with Art. 16 (elimination after the end of processing) and increases the exposure surface without benefit.
• Mapping: Art. 15 and 16 (elimination); ISO 27001:2022 Annex A 8.13 (backup) and 8.10 (information destruction).

Finding 5 — [INFO] Incident notification flow non-existent in practice

The incident response plan existed on paper, but there was no operational runbook: no ANPD contact list, no data subject communication template, no definition of who decides on notification within the Art. 48 deadline.

• LGPD impact: Art. 48 requires communication within a reasonable timeframe to the ANPD and to data subjects when the incident may entail relevant risk or harm. Without a tested flow, the controller tends to notify too late — and the delay becomes an aggravating factor.
• Mapping: Art. 48; ISO 27001:2022 Annex A 5.24/5.25 (incident planning and response).

Finding 6 — [HIGH] Data Protection Officer (DPO) not formally appointed nor notified to the ANPD

VitaCare had the "DPO" figure only informally — a compliance analyst accumulating the role without formal appointment, without a public communication channel with data subjects and without the communication record to the ANPD.

• LGPD impact: Art. 41 requires the controller to appoint a data protection officer (DPO), with identity and contact publicly disclosed (§1), and the ANPD keeps a registry of DPOs on its portal. Without formal appointment, the company fails a structural governance requirement — and the ANPD inquiry (Art. 18, §1 petition) had no official response channel.
• Mapping: Art. 41 (DPO); ISO 27001:2022 Annex A 5.1 (policies), 5.34 (privacy and PII protection).

Finding 7 — [MEDIUM] DPIA not carried out for large-scale sensitive data processing

The platform processed health data of 60,000 patients — large-scale processing of sensitive data — without a Data Protection Impact Assessment (DPIA).

• LGPD impact: Art. 38 authorizes the ANPD to require the controller to prepare a DPIA when processing may entail risks to civil liberties and fundamental rights — and Art. 55-J, IV allows the authority to request information about processing operations at any time. The pentest, with its mapping of the sensitive data surface and processing flows, is direct input for the DPIA (inventory, risks and controls).
• Mapping: Art. 38 (DPIA); Art. 5, II (sensitive data) and 5, X (large-scale processing); ISO 27001:2022 Annex A 5.34 (privacy and PII protection).

---

4. Why "documented measures" are not enough (the accountability logic)

Before the test, VitaCare had a reasonable collection of policies: security policy, password policy, access matrix. On paper, it looked up to date. The ANPD inquiry, however, does not ask "do you have a policy?" — it asks "how do you know it works?".

The contrast between the two answers:

The pentest does not "prove the company is secure" — it proves the company knows what it does not know, which is the real requirement of accountability (Art. 6, X): documenting the effectiveness evaluation, including (and especially) when it finds flaws. For the ANPD, a company that tests, finds and remediates is qualitatively different from one that never tested.

---

5. The pentest report as a compliance dossier

The report VitaCare attached to its response to the ANPD had a specific structure — the same one we recommend to any organization that wants to use pentest as evidence:

1. Scope and authorization: tested domains, IPs, APIs and periods; confirmation that the test was authorized in writing. This delimits what the evidence covers.
2. Methodology: PTES/OWASP WSTG standard, phases executed, tools and manual work. The ANPD does not require a specific methodology, but the absence of method weakens the evidence.
3. Findings with reproduction: each vulnerability with step-by-step reproduction, proven impact and severity. A finding without reproduction is not evidence — it is opinion.
4. Regulatory mapping: each finding linked to the LGPD article and the corresponding ISO 27001 control. This is the column that turns a technical report into a compliance document.
5. Remediation plan with deadlines: fixes prioritized by risk, with owner and date.
6. Retest: reassessment after remediation, documenting that the finding was closed. The test → fix → retest cycle is what demonstrates the continued "effectiveness evaluation" required by accountability (Art. 6, X).

This same report serves three audiences at once: the ANPD (inquiry), the DPO (evidence for the impact assessment), and B2B clients that require contractual security guarantees in data processing.

---

6. LGPD, PCI-DSS and ISO 27001: where pentest fits in

Companies that process cards (PCI) or hold ISO certification already need periodic testing — the same report serves as evidence for all three fronts. It is not triple cost; it is the same evidence leveraged across three audits.

---

7. Checklist for the DPO: using pentest as LGPD evidence

• Scope covers what the LGPD protects: include APIs, legacy systems and flows with sensitive data in the test scope — not just the institutional website
• Formal written authorization before any test (golden rule of Art. 46 and of criminal law itself)
• Documented methodology (PTES/OWASP WSTG) and manual work beyond scanners
• Every finding with reproduction and proven impact
• Regulatory mapping: finding → LGPD article → ISO 27001 control (include Art. 41 — DPO — and Art. 38 — DPIA — when applicable)
• DPO formally appointed (Art. 41): verify that the response channel for data subjects and the authority exists in practice
• DPIA for risky processing (Art. 38): assess whether large-scale sensitive data processing requires an impact assessment — and use the pentest inventory as input
• Remediation plan with deadlines and owners
• Documented retest after fixes
• Keep everything: report, reproduction evidence, retest proof — for at least the retention cycle defined in the policy
• Review the Art. 48 flow: if an incident happens tomorrow, who notifies the ANPD, within how long, and with what information?
• Repeat on a defined cadence — the effectiveness evaluation of accountability (Art. 6, X) is continuous, not a one-off event

---

This article describes a fully fictitious laboratory scenario, built for educational purposes. No real client data was used. Exploiting vulnerabilities in systems without explicit authorization is illegal.

Want to know whether your security measures would pass an ANPD inquiry? intrus.io's service combines pentest (web, API and network) with the Intrus Conformidade add-on — a report mapped by LGPD article and ISO 27001 control, ready for the DPO and for the authority. We are at your disposal.