CIVIL LIABILITY IN DATA BREACHES

Abstract

This article examines civil liability for personal data breaches under the Brazilian General Data Protection Law (LGPD) and recent national case law. The study aims to analyze the legal and doctrinal foundations that guide the liability of data controllers and processors — both public and private — in the event of security incidents that compromise data subjects' privacy. The research adopts a bibliographic methodology with a deductive approach and includes analysis of decisions from the Superior Court of Justice (STJ). The main findings point to the predominance of strict liability, grounded in the theories of enterprise risk and administrative risk, and the increasing recognition of presumed moral damages in cases involving sensitive data. The study concludes that civil liability plays a key role in ensuring the effectiveness of data protection and strengthening digital trust in contemporary legal and social relations.