Final answer:
Per the LGPD, communication to the national authority and the data subject regarding a security incident must be done.
Step-by-step explanation:
Per the LGPD (Lei Geral de Proteção de Dados), communication to the national authority and the data subject regarding the occurrence of a security incident that may create risk or relevant damage to the data subject shall be done.