Solutions02 · Privacy and governance
Privacy, data and AI.
Understand which data was affected, organise the response and strengthen governance. We provide technical findings for counsel and the DPO, including support for data-subject notification.
Context
Incident decisions begin before all the facts are known.
Which data was affected? How many people are involved? What has been preserved? We organise the technical facts so the controller, supported by counsel, can assess notification to the ANPD and affected individuals within the applicable deadlines.
We analyse available data, identify categories of exposure and consolidate affected individuals. Findings state their sources and limitations; legal assessment and notification decisions remain with the controller and its advisers.
Process
Six stages, from first call to closed incident.
Each stage closes with an artefact counsel can rely on in the communication to the ANPD, to data subjects and, if needed, in litigation.
- 01
Initial assessment
Initial assessment with counsel and IT: systems involved, timeline and available copies of the affected data.
Deliverable: incident scoping note
- 02
Preservation
Forensic preservation of logs, exfiltrated sets and affected systems, with hashes and chain of custody.
Deliverable: preservation record
- 03
Data mining
Automated and AI-assisted scan of the exposed data for personal and sensitive data, by document and by field.
Deliverable: exposure map by data category
- 04
Data-subject list
Consolidation and de-duplication of affected people across files, with contact data where available.
Deliverable: consolidated data-subject list
- 05
Notification support
Facts and figures for the ANPD communication and data-subject notices, plus mass notification and a contact centre run with delivery and call-centre partners.
Deliverable: technical annex to the communication
- 06
Closure
Report on what was observed, what was inferred and the limits of the analysis, ready for regulators, insurers or courts.
Deliverable: final technical report
Scope
From incident response to ongoing governance.
- 01
Incident response
Mining of the exposed data, affected data subjects and technical support for the ANPD communication, with every number taken from the data itself.
- 02
Mass notification
Letters, email and SMS to data subjects with a contact centre for questions, run with partners and traceable to the data-subject list.
- 03
Information governance
Data mapping and technical implementation of retention and disposal, using criteria agreed with counsel.
- 04
AI governance
Inventory of models and use cases, data-flow assessment and technical controls to support AI policies and copilot adoption.
Frequently asked questions
- When does the incident need to be communicated to the ANPD?
- The general rule requires the controller to notify the ANPD and affected individuals within three business days where there is relevant risk or harm. Counsel assesses the starting point, exceptions and applicable deadline; we provide technical findings.
- Do you replace our breach counsel?
- No. LexNexo provides technical services and does not practise law. We work alongside in-house counsel or the law firm leading the response.
- Can you work with data published on a leak site?
- We work with copies obtained lawfully by the client or counsel and preserved with hashes. The acquisition strategy is decided with counsel.
- How do you find sensitive data in unstructured files?
- By combining pattern detection, AI classification evaluated on Portuguese and sampling with human review, all recorded with metrics.
- Do you write our retention or AI policies?
- We map data, models and retention as they work in practice and deliver the technical basis; the policy text and its legal assessment stay with counsel.
- How is it charged?
- Per project with a fixed scope for the incident, or as a retainer subscription with response times agreed in advance.
Contact
Need support with an incident?
Describe the systems involved and the urgency, without sending exposed data. We will confirm response availability. Counsel should assess legal deadlines immediately.