Skip to content
AI Policy Generator

ESWhat applies

Credit or creditworthiness scoring in Brazil: related rules

Models that estimate a person's likelihood of default or creditworthiness to approve, deny or price credit. It is high-risk in the EU and Peru and requires explaining denial reasons and allowing human review in almost every jurisdiction.

Risk classification

JurisdictionLevelDateNote
BrazilData protection—LGPD Art. 20: review and explanation of automated decisions, including credit profiles.

Obligations related to this use case

Review of automated decisions (art. 20)

LGPDLGPD, art. 20In force

Already applicable

When it relates
If you make decisions based solely on automated processing that affect people's interests, including profiling (credit, employment, insurance, consumer). Clinical support where the physician makes the final decision is not, in principle, a solely automated decision.
What the rule provides
  • Handle requests to review these decisions.
  • Give clear information on the criteria and procedures used, while respecting trade secrets.
  • If the information is withheld, the ANPD may audit the system for possible discrimination.
  • Provide human review for high-impact decisions; the ANPD is working on rules for this right (public consultation and Technical Note 12/2025).
Typical evidence
  • Review procedure and request log.
  • Explanations provided.
Verification
Verified in the official source on November 4, 2026Checked against the consolidated text of Law 13,709/2018 published by the Chamber of Deputies (Legislação Informatizada), art. 20, caput and §§ 1-2 (ANPD audit if information is withheld on trade-secret grounds). The possible rulemaking on human review comes from ANPD consultation documents. Planalto did not respond in this review.

Data protection impact report (RIPD)

LGPDLGPD, arts. 10 §3 y 38In force

Already applicable

When it relates
If you carry out high-risk processing: automated decisions, biometrics, sensitive or children's data, monitoring or model training.
What the rule provides
  • Have the RIPD ready to hand over when the ANPD requests it.
  • Follow ANPD guidance (2023), which lists solely automated decisions among high-risk criteria; the specific regulation is still pending.
Typical evidence
  • Dated RIPD per system.
Verification
Verified in the official source on November 4, 2026Checked against the consolidated text of Law 13,709/2018 published by the Chamber of Deputies (Legislação Informatizada), arts. 10 § 3 and 38 (the ANPD may request the RIPD). That the specific RIPD regulation is still pending comes from the ANPD agenda and secondary sources (Mattos Filho, Confidata). Planalto did not respond in this review.

Appoint and publish the data protection officer

ANPD Res. 18/2024 (DPO)LGPD, art. 41; Res. CD/ANPD 18/2024, arts. 3, 8 a 10 y 18In force

Already applicable

When it relates
If you are not a small-scale agent, or if you are but carry out high-risk processing (sensitive data, automated decisions, biometrics, monitoring).
What the rule provides
  • Formally appoint the officer and publish their identity and contact details on the website.
  • Give them autonomy, resources and access to senior management; avoid conflicts of interest.
Typical evidence
  • Appointment act and website disclosure.
Verification
Verified in the official source on November 4, 2026Checked against the LGPD (art. 41, Chamber of Deputies text) and the text of CD/ANPD Res. 18/2024 published by the ANPD on gov.br: art. 3 (formal appointment), 9 (publish identity and contact on the website), 10 (resources and technical autonomy) and 18 (conflict of interest).

Related base documents

Related kits

Includes 7 documents

Credit and Insurance Kit

Model risk with inventory and materiality, adverse-decision explanation letters, human review, a decision log, technical model documentation and the EU AI Act Art. 26 checklist for high-risk systems.

USD 139USD 253

Complete kit · available to buy

Find out what applies to you (free)Brazil