Hotel data breach: what to do in the first 48 hours

The clock starts when you become aware, not when the technical picture is confirmed

A common mistake in hotels facing a security incident for the first time is to wait until the IT team is "sure" about what happened before involving management or thinking about notification. The LGPD does not work that way. Article 48 requires the controller to notify the ANPD (Brazil's data protection authority) and, where applicable, the data subjects, within a reasonable time from the moment it becomes aware of the incident, and ANPD Resolution No. 15/2024 (in Portuguese) sets that time at 3 business days when the incident may cause relevant risk or harm to data subjects (small processing agents have twice the time). The information can be supplemented later, with justification, within 20 business days.

In practice, this means the decision to notify has to be taken on the basis of what is known in the first hours, even if the full investigation is still under way. Hotels that only formalise that decision days later, waiting for a definitive technical report, may already be past the deadline when they finally act.

The first 2 hours: contain without destroying evidence

The usual instinct with a compromised system is to switch it off, reinstall it or delete suspicious files. That is exactly what should not happen before the essentials are preserved:

• Isolate without switching off, where possible: disconnect the affected system from the network (network cable or Wi-Fi) instead of shutting it down, preserving the state of memory for possible forensic analysis. There are situations where shutting down is the right containment, and that decision belongs to whoever is leading the incident response.
• Revoke compromised credentials: change passwords and revoke access tokens for accounts that may have been used in the incident, including service accounts and PMS integrations.
• Preserve logs: copy access, VPN, firewall and PMS logs before automatic rotation overwrites them, which on some systems happens on a short cycle.
• Do not reinstall yet: reinstalling the operating system or restoring a clean backup destroys the evidence needed to understand what was accessed, information the notification to the ANPD itself requires you to describe.
• Trigger contracts and insurance: if the hotel has cyber insurance, check the policy conditions, which may require immediate notice and the use of response firms and legal advisers appointed by the insurer. If the incident involves the PMS, an OTA or a cloud service, contact the supplier through the escalation channel set out in the contract and record the time of the notice.

The first 8 hours: build a picture of what happened

Before notifying any authority, the hotel needs minimum answers, even provisional ones, to three questions: what was accessed, how many data subjects were potentially affected, and whether the incident has been contained. This normally involves:

1. Establishing which systems were compromised (PMS, email, backup, website) and which tables or categories of data they hold.
2. Estimating, even as a range, how many guests or employees had data potentially exposed.
3. Checking for signs of data exfiltration (unusual outbound traffic, access to large volumes of records) as opposed to unauthorised access without data being copied.
4. Recording a timeline: when the incident began, when it was detected and when the team became formally aware of it. That last milestone is what starts the notification clock.

Deciding whether notifying the ANPD is mandatory

Not every security incident has to be formally notified. The obligation arises when the incident may cause relevant risk or harm to data subjects. Under ANPD Resolution No. 15/2024, that happens when the incident may significantly affect data subjects' interests and fundamental rights and involves, for example, sensitive data, data on children, adolescents or older people, financial data such as payment data, authentication data for systems, data protected by confidentiality, or data at large scale. Unauthorised access that was contained quickly, with no evidence of exfiltration and no sensitive data involved, may not require formal notification, but that decision must be documented with its technical justification, not assumed by the IT team under pressure. The same resolution requires the controller to keep a record of all incidents involving personal data, including those not reported, for at least five years.

When notification is due, it must include, at a minimum: a description of the nature of the affected data, the data subjects involved, the technical and security measures already in place to protect the data (subject to trade secrets), the risks related to the incident, and the measures taken or to be taken to reverse or mitigate its effects.

Telling the affected guests

When the risk to data subjects is relevant, the hotel also has to notify the affected guests, not only the ANPD, within the same 3 business days. That communication should be written in plain, direct language, without playing down what happened or causing unnecessary alarm, and cover the same points required in the notification to the authority: what happened, which data was affected, what the hotel has already done and what the guest can do to protect themselves (for example, monitoring transactions on the card used for the booking).

Communicating late, or only after the incident has leaked to the press or social media, tends to carry a higher reputational cost than a transparent, timely communication from the hotel itself.

Why hotels miss this window

Often the problem is not technical. It is the lack of an incident response plan defined before the crisis: who decides to notify, who writes the communication, who the legal point of contact is, and which security supplier is called in for the technical investigation. Without this defined in advance, these decisions are taken for the first time during the incident itself, with the legal deadline already running and under pressure, which are exactly the worst conditions for deciding well.

A tested incident response plan, with clear roles and a ready communication script, is what separates a hotel that meets the 3 business day deadline from one that is still debating internally what happened when the deadline has already passed.

Next steps

Preparing this response before you need it is the most effective work a hotel can do in this area. That includes a documented incident response plan, defined roles and a technical containment checklist aligned with the LGPD obligations. Our team builds this plan with the hotel and, in a real incident, coordinates the response between the hotel, its suppliers and the forensics and containment specialists. Talk to our team.

Sources

• ANPD, Resolução CD/ANPD nº 15, Regulamento de Comunicação de Incidente de Segurança (security incident reporting regulation, April 2024, in Portuguese), in.gov.br
• ANPD, Resolução CD/ANPD nº 2, Regulamento de aplicação da LGPD para agentes de tratamento de pequeno porte (LGPD regulation for small processing agents, January 2022, in Portuguese), in.gov.br
• ANPD, Comunicação de Incidente de Segurança (security incident reporting page, in Portuguese), gov.br/anpd