Skip to content
AI Policy Generator

ESWhat applies

Brazil · Law

Brazil's General Personal Data Protection Law (LGPD)

In forceLGPD

Summary

It is the region's most mature data law. It requires a legal basis, transparency, records of processing, a data protection officer and security. Its art. 20 gives people the right to request review of solely automated decisions and to learn their criteria. The ANPD can demand an impact report and makes AI an enforcement priority for 2026-2027. Documents submitted to the ANPD or other Brazilian regulators must be in Portuguese.

Who it applies to

Any organization that processes personal data in Brazil, of people in Brazil or to offer goods or services in Brazil.

Penalties

Warning; fine of up to 2% of revenue in Brazil, capped at R$50 million per violation; daily fine; publication of the violation; blocking or deletion of data and suspension of activities (art. 52; penalty calculation in ANPD Res. 4/2023).

Official name
Lei nº 13.709, de 14 de agosto de 2018 – Lei Geral de Proteção de Dados Pessoais (LGPD)
Official reference
Lei nº 13.709/2018, DOU 15-ago-2018; vigente desde el 18-sep-2020; sanciones administrativas aplicables desde el 1-ago-2021
Regulator
National Data Protection Authority (ANPD)
Official source
Check the sourceHow we verify sources

Key dates

Obligations and dates

Obligations table
ObligationArticle or citationStatusDateWho it applies toVerification
Legal basis and transparency for AI processingLGPD, arts. 7, 9, 10 y 11In forceAlready applicableIf you process personal data of people in Brazil, including in AI systems.Verified in the official source on November 4, 2026
Record of processing operationsLGPD, art. 37In forceAlready applicableIf you process personal data; small-scale agents may keep a simplified record (ANPD Res. 2/2022).Verified in the official source on November 4, 2026
Review of automated decisions (art. 20)LGPD, art. 20In forceAlready applicableIf you make decisions based solely on automated processing that affect people's interests, including profiling (credit, employment, insurance, consumer). Clinical support where the physician makes the final decision is not, in principle, a solely automated decision.Verified in the official source on November 4, 2026
Data protection impact report (RIPD)LGPD, arts. 10 §3 y 38In forceAlready applicableIf you carry out high-risk processing: automated decisions, biometrics, sensitive or children's data, monitoring or model training.Verified in the official source on November 4, 2026
Data subject rightsLGPD, art. 18In forceAlready applicableIf you process personal data.Verified in the official source on November 4, 2026
Security measuresLGPD, art. 46In forceAlready applicableIf you process personal data.Verified in the official source on November 4, 2026
Children's and teenagers' dataLGPD, art. 14In forceAlready applicableIf you process data of children or teenagers, or your users may be minors.Verified in the official source on November 4, 2026

Legal basis and transparency for AI processing

LGPD, arts. 7, 9, 10 y 11In force

Already applicable

When it relates
If you process personal data of people in Brazil, including in AI systems.
What the rule provides
  • Choose and document the legal basis for each processing activity; for legitimate interest, carry out and keep the balancing test.
  • Use only art. 11 bases for sensitive data.
  • Clearly disclose the purpose, manner and duration of processing, including AI uses.
Typical evidence
  • Published privacy policy.
  • Legitimate interest assessments.
Verification
Verified in the official source on November 4, 2026Checked against the consolidated text of Law 13,709/2018 published by the Chamber of Deputies (Legislação Informatizada), arts. 7, 9, 10 and 11. Planalto did not respond in this review.

Record of processing operations

LGPD, art. 37In force

Already applicable

When it relates
If you process personal data; small-scale agents may keep a simplified record (ANPD Res. 2/2022).
What the rule provides
  • Record processing operations, including each AI system's, with purpose, data, legal basis and recipients.
Typical evidence
  • Up-to-date record.
Verification
Verified in the official source on November 4, 2026Checked against the consolidated text of Law 13,709/2018 published by the Chamber of Deputies (Legislação Informatizada), art. 37. Planalto did not respond in this review.

Review of automated decisions (art. 20)

LGPD, art. 20In force

Already applicable

When it relates
If you make decisions based solely on automated processing that affect people's interests, including profiling (credit, employment, insurance, consumer). Clinical support where the physician makes the final decision is not, in principle, a solely automated decision.
What the rule provides
  • Handle requests to review these decisions.
  • Give clear information on the criteria and procedures used, while respecting trade secrets.
  • If the information is withheld, the ANPD may audit the system for possible discrimination.
  • Provide human review for high-impact decisions; the ANPD is working on rules for this right (public consultation and Technical Note 12/2025).
Typical evidence
  • Review procedure and request log.
  • Explanations provided.
Verification
Verified in the official source on November 4, 2026Checked against the consolidated text of Law 13,709/2018 published by the Chamber of Deputies (Legislação Informatizada), art. 20, caput and §§ 1-2 (ANPD audit if information is withheld on trade-secret grounds). The possible rulemaking on human review comes from ANPD consultation documents. Planalto did not respond in this review.

Data protection impact report (RIPD)

LGPD, arts. 10 §3 y 38In force

Already applicable

When it relates
If you carry out high-risk processing: automated decisions, biometrics, sensitive or children's data, monitoring or model training.
What the rule provides
  • Have the RIPD ready to hand over when the ANPD requests it.
  • Follow ANPD guidance (2023), which lists solely automated decisions among high-risk criteria; the specific regulation is still pending.
Typical evidence
  • Dated RIPD per system.
Verification
Verified in the official source on November 4, 2026Checked against the consolidated text of Law 13,709/2018 published by the Chamber of Deputies (Legislação Informatizada), arts. 10 § 3 and 38 (the ANPD may request the RIPD). That the specific RIPD regulation is still pending comes from the ANPD agenda and secondary sources (Mattos Filho, Confidata). Planalto did not respond in this review.

Data subject rights

LGPD, art. 18In force

Already applicable

When it relates
If you process personal data.
What the rule provides
  • Handle confirmation, access, correction, anonymization, portability, deletion, sharing information and consent withdrawal requests.
Typical evidence
  • Request log.
Related base documents
Verification
Verified in the official source on November 4, 2026Checked against the consolidated text of Law 13,709/2018 published by the Chamber of Deputies (Legislação Informatizada), art. 18. Planalto did not respond in this review.

Security measures

LGPD, art. 46In force

Already applicable

When it relates
If you process personal data.
What the rule provides
  • Adopt technical and administrative measures to protect data by design, including data sent to AI tools.
Typical evidence
  • Security policy.
Related base documents
Verification
Verified in the official source on November 4, 2026Checked against the consolidated text of Law 13,709/2018 published by the Chamber of Deputies (Legislação Informatizada), art. 46 and § 2 (measures "from the design stage"). Planalto did not respond in this review.

Children's and teenagers' data

LGPD, art. 14In force

Already applicable

When it relates
If you process data of children or teenagers, or your users may be minors.
What the rule provides
  • Process data in the child's best interest and, for children, with specific consent from a parent or guardian, except where exempt.
Typical evidence
  • Parental consent mechanism.
Verification
Verified in the official source on November 4, 2026Checked against the consolidated text of Law 13,709/2018 published by the Chamber of Deputies (Legislação Informatizada), art. 14, caput and § 1. Planalto did not respond in this review.

Related rules

Regulatory change alerts by country

Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.

  • Changes to the rules of the countries you pick, when we add them to the registry.
  • New application dates.
  • No more than one email a week. Unsubscribe at any time.

It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.

Countries · Pick one or more.
US states
Email language
Manage my alerts

Find out what applies to you (free)