Brazil’s LGPD and AI: The ANPD’s Role

Brazil’s LGPD, Law No. 13,709/2018, applies to processing personal data in Brazil and to covered processing linked to people in Brazil, regardless of whether the tool is called AI. It defines personal data broadly and identifies sensitive categories such as health data and biometric data linked to a natural person. Controllers must comply with principles including purpose, adequacy, necessity, transparency, security, prevention, non-discrimination and accountability, and must have an applicable legal basis. Training and inference can both involve regulated processing; using a model does not itself create a new lawful basis. Article 20 gives the data subject the right to request review of decisions taken solely on the basis of automated processing of personal data that affect their interests, including decisions defining personal, professional, consumer or credit profiles. The current text does not promise that every review will be performed by a human. The controller must provide clear and adequate information about criteria and procedures, subject to industrial and commercial secrecy, and the ANPD may audit aspects where secrecy is invoked to protect discrimination. This is a data-protection right with its own scope, not a general AI appeal right for every output. The ANPD is Brazil’s data-protection authority and an independent regulatory agency following 2026 institutional changes. Its 2025–2026 agenda lists an AI project to develop interpretive parameters for Article 20 and other LGPD issues; the project remains in progress. PL 2338/2023 passed the Senate and was sent to the Chamber in March 2025, where it was referred to a special committee and remains under legislative consideration in September 2026. Do not describe that bill as enacted law or treat ANPD’s consultation and agenda as binding AI regulations.