Skip to content
AI Policy Generator

ESWhat applies

Access to public services or benefits in Brazil: related rules

AI used by public bodies or their suppliers to decide or prioritize access to subsidies, aid, social or health services, or permits. It affects vulnerable people and fundamental rights, so it requires impact assessment, transparency and human review.

Risk classification

JurisdictionLevelDateNote
BrazilMinimal risk or no specific regime—Bill PL 2338 would ban government social scoring and treat public services as high-risk.

Obligations related to this use case

Review of automated decisions (art. 20)

LGPDLGPD, art. 20In force

Already applicable

When it relates
If you make decisions based solely on automated processing that affect people's interests, including profiling (credit, employment, insurance, consumer). Clinical support where the physician makes the final decision is not, in principle, a solely automated decision.
What the rule provides
  • Handle requests to review these decisions.
  • Give clear information on the criteria and procedures used, while respecting trade secrets.
  • If the information is withheld, the ANPD may audit the system for possible discrimination.
  • Provide human review for high-impact decisions; the ANPD is working on rules for this right (public consultation and Technical Note 12/2025).
Typical evidence
  • Review procedure and request log.
  • Explanations provided.
Verification
Verified in the official source on November 4, 2026Checked against the consolidated text of Law 13,709/2018 published by the Chamber of Deputies (Legislação Informatizada), art. 20, caput and §§ 1-2 (ANPD audit if information is withheld on trade-secret grounds). The possible rulemaking on human review comes from ANPD consultation documents. Planalto did not respond in this review.

Data protection impact report (RIPD)

LGPDLGPD, arts. 10 §3 y 38In force

Already applicable

When it relates
If you carry out high-risk processing: automated decisions, biometrics, sensitive or children's data, monitoring or model training.
What the rule provides
  • Have the RIPD ready to hand over when the ANPD requests it.
  • Follow ANPD guidance (2023), which lists solely automated decisions among high-risk criteria; the specific regulation is still pending.
Typical evidence
  • Dated RIPD per system.
Verification
Verified in the official source on November 4, 2026Checked against the consolidated text of Law 13,709/2018 published by the Chamber of Deputies (Legislação Informatizada), arts. 10 § 3 and 38 (the ANPD may request the RIPD). That the specific RIPD regulation is still pending comes from the ANPD agenda and secondary sources (Mattos Filho, Confidata). Planalto did not respond in this review.

Appoint and publish the data protection officer

ANPD Res. 18/2024 (DPO)LGPD, art. 41; Res. CD/ANPD 18/2024, arts. 3, 8 a 10 y 18In force

Already applicable

When it relates
If you are not a small-scale agent, or if you are but carry out high-risk processing (sensitive data, automated decisions, biometrics, monitoring).
What the rule provides
  • Formally appoint the officer and publish their identity and contact details on the website.
  • Give them autonomy, resources and access to senior management; avoid conflicts of interest.
Typical evidence
  • Appointment act and website disclosure.
Verification
Verified in the official source on November 4, 2026Checked against the LGPD (art. 41, Chamber of Deputies text) and the text of CD/ANPD Res. 18/2024 published by the ANPD on gov.br: art. 3 (formal appointment), 9 (publish identity and contact on the website), 10 (resources and technical autonomy) and 18 (conflict of interest).

Related base documents

Related kits

Includes 7 documents

Public Sector AI Kit

Base documents for public bodies and their suppliers: AI lead, governance model, inventory, algorithmic and fundamental rights impact assessments, human oversight and explanation to citizens.

USD 189USD 313

Complete kit · available to buy

Find out what applies to you (free)Brazil