LGPD penetration testing: documented technical evidence for Article 46 of Brazil's LGPD.

Brazil's General Data Protection Law (Law 13,709/2018) doesn't mention penetration testing by name. What it requires is broader — and therefore much harder to meet without concrete technical evidence.

Art. 46. Processing agents shall adopt security, technical and administrative measures able to protect personal data from unauthorized access and from accidental or unlawful situations of destruction, loss, alteration, communication or any form of improper or unlawful processing.

“Technical measures able to protect.” What does that mean in practice? The ANPD hasn't published a checklist. But in actual inspection cases, three things carry the most weight:

1. A documented security policy — can be written in-house
2. Team training — can be done in-house
3. A recent penetration test — requires an independent technical third party

The first two are self-declared. The third is the only one that proves your company did what's expected of a diligent company.

In an inspection, the ANPD typically asks for documentary evidence of the technical and organizational measures adopted:

• Privacy and information security policy
• Personal data inventory and legal bases (Art. 7 and Art. 11)
• Record of processing activities (Art. 37)
• Incident response plan
• Evidence of recent security testing — pentest, vulnerability scanning, code review
• DPIA (Data Protection Impact Assessment) for high-risk processing

Without the pentest item, the company's defense is weaker. With a recent documented pentest (≤ 12 months), the company demonstrates a posture of due care — which reduces the severity of any administrative sanction.

LGPD fines go up to 2% of revenue in Brazil (capped at R$ 50 million per violation). A pentest costs a fraction of 1% of that. The math is trivial.

Personal data collection and storage

• Endpoints that collect data — forms, APIs, webhooks
• Data leakage through responses (excessive data exposure)
• BOLA — user A accessing user B's personal data
• Logs with personal data in plain text (improper internal access)
• Publicly exposed backups (S3, GCS)
• Cache poisoning leaking data between users

Data subject rights (Art. 18)

• Access — the endpoint leaks third-party data via IDOR/BOLA
• Correction — mass assignment allows changing sensitive fields
• Anonymization/Deletion — the endpoint doesn't fully anonymize; data persists in logs/backups
• Portability — the export endpoint leaks other data subjects' data

Sharing with processors

• SSRF via webhooks to processors (leakage by proxy)
• Replay of sensitive events
• Signature bypass in third-party integrations
• Logs shared beyond what's necessary

Incident response (Art. 48)

• Ability to detect unauthorized access attempts
• An adequate audit trail
• Time to detection and containment

Cross-cutting hardening

• Full OWASP Top 10 (XSS, SQLi, SSRF, deserialization)
• Full OWASP API Top 10 (BOLA, BFLA, BOPLA, mass assignment)
• Authentication, sessions and MFA
• Cloud configuration (S3, IAM, IMDSv1)

No Vuln's LGPD pentest report is structured to serve as immediate documentary evidence in any inspection or audit:

• Executive summary aligned with Art. 46 — a formal statement of technical measures
• Findings × personal data map — each vulnerability linked to the type of personal data exposed
• Calibrated severity with CVSS 4.0 + LGPD impact (leakage, loss, unauthorized alteration)
• Remediation plan with 30/60/90-day priorities
• Retest included within the plan's timeline — an updated report after the fix strengthens the evidence
• Signed compliance statement, dated and with a clear scope

The document serves as evidence for:

• The ANPD in administrative inspections
• Enterprise customer contractual audits (security clauses)
• M&A and investment due diligence
• Cyber insurance renewals and new policies

Every engagement gets a custom quote once the scope is defined. The hourly rate ranges from US$ 150 to US$ 250 depending on stack, testing mode and timeline — larger packages have a lower hourly rate. Invoiced in USD via Wise or international wire transfer: 50% at kickoff, 50% on delivery.