Society GUIDE
Brazil’s LGPD and AI: The ANPD’s Role
Brazil’s General Data Protection Law (LGPD) already governs personal data used to train or operate AI, and Article 20 gives data subjects a right to request review of certain decisions made solely through automated processing.
On this page3 min read
Overview
The ANPD applies and enforces data-protection law and has AI-related regulatory work underway; Brazil’s general AI bill, PL 2338/2023, remains a proposal in the Chamber as of September 2026.
Deep Dive
Brazil’s LGPD, Law No. 13,709/2018, applies to processing personal data in Brazil and to covered processing linked to people in Brazil, regardless of whether the tool is called AI. It defines personal data broadly and identifies sensitive categories such as health data and biometric data linked to a natural person. Controllers must comply with principles including purpose, adequacy, necessity, transparency, security, prevention, non-discrimination and accountability, and must have an applicable legal basis. Training and inference can both involve regulated processing; using a model does not itself create a new lawful basis.
Article 20 gives the data subject the right to request review of decisions taken solely on the basis of automated processing of personal data that affect their interests, including decisions defining personal, professional, consumer or credit profiles. The current text does not promise that every review will be performed by a human. The controller must provide clear and adequate information about criteria and procedures, subject to industrial and commercial secrecy, and the ANPD may audit aspects where secrecy is invoked to protect discrimination. This is a data-protection right with its own scope, not a general AI appeal right for every output.
The ANPD is Brazil’s data-protection authority and an independent regulatory agency following 2026 institutional changes. Its 2025–2026 agenda lists an AI project to develop interpretive parameters for Article 20 and other LGPD issues; the project remains in progress. PL 2338/2023 passed the Senate and was sent to the Chamber in March 2025, where it was referred to a special committee and remains under legislative consideration in September 2026. Do not describe that bill as enacted law or treat ANPD’s consultation and agenda as binding AI regulations.
Strategic Impact
Risk and safety
Catastrophic and everyday AI harms both depend on who understands the risks and who can act.
Clearer decisions
Public and professional literacy shapes whether strong safety policy is politically possible.
Cutting through hype
Clear explanations reduce capture by hype, lab PR, and vague ethics theater.
The Future of Brazil’s LGPD and AI: The ANPD’s Role
ANPD’s agenda identifies AI and high-risk processing as ongoing regulatory projects, and its 2026 priorities include AI and emerging technologies involving personal data. Those activities may produce guidance or rules later, but do not replace the LGPD currently in force. Recheck the Chamber’s PL 2338 record and ANPD’s official agenda before treating a proposal, consultation or technical sandbox as a binding requirement. Maintain a dated record of the official text and check for new laws, court interpretations and agency guidance before each material update to policy or system use.
Real-World Implementation
A lender checks whether an automated credit profile makes a decision based solely on personal data and provides a channel for an Article 20 review request.
A model team documents the LGPD legal basis, purpose, data minimization and security controls for training data containing personal information.
A privacy officer tracks ANPD’s AI project separately from binding LGPD duties and from the still-pending general AI bill.
A product manager identifies whether biometric or health inputs are sensitive personal data and verifies the applicable legal basis before use.
Risks & Guardrails
Treating existential risk as sci-fi while capability compounds.
Confusing surface product safety with alignment under high autonomy.
Leaving non-English and non-expert audiences with only low-quality sources.
Implementation Roadmap
Separate product harms, misuse, and loss-of-control / misalignment risks.
Ask what evidence would change your view on timelines and severity.
Prefer primary sources and concrete evals over marketing claims.
Identify one action path: career, policy, funding, or skills — not only awareness.
Keep Exploring
Free newsletter
Keep up with AI in 3 minutes a day
One short email each weekday with the three AI stories that actually matter. Free forever, no ads.
One email each weekday. Unsubscribe in one click. We never sell or share your address.
Test yourself
Take the Brazil’s LGPD and AI: The ANPD’s Role quiz
Instant feedback on every answer, and a shareable certificate with a verifiable ID once you pass a course.
Support free AI education. AI Understanding is a 501(c)(3) nonprofit — no ads, no paywall, ever. Make a donation
Frequently asked questions
What is Brazil’s LGPD and AI: The ANPD’s Role?
Brazil’s General Data Protection Law (LGPD) already governs personal data used to train or operate AI, and Article 20 gives data subjects a right to request review of certain decisions made solely through automated processing. The ANPD applies and enforces data-protection law and has AI-related regulatory work underway; Brazil’s general AI bill, PL 2338/2023, remains a proposal in the Chamber as of September 2026.
What does LGPD Article 20 let a data subject request?
Article 20 establishes a request-for-review right for qualifying decisions based solely on automated processing that affect the person’s interests.
Does the current text of Article 20 guarantee that a natural person must perform every review?
Article 20 says a data subject may request review; its current text does not specify that every review must be by a human.
Which is a sensitive-data category under the LGPD when linked to a natural person?
The LGPD includes biometric data linked to a natural person among sensitive personal data.
Where does PL 2338/2023 stand as of September 2026?
The Senate record shows referral to the Chamber; the Chamber docket places it in a special committee with later 2026 activity.
Which role does the ANPD perform in Brazil’s data-protection system?
The ANPD enforces the LGPD and lists an AI regulatory project focused on Article 20 and other data-protection issues.
Keep learning
Related guides
More guides picked for this topic