Worker monitoring in Brazil: related rules

Using AI to track workers' activity, productivity, location, behavior or state through cameras, software or sensors. It clashes with privacy and dignity, so it requires proportionality and prior notice, and in the EU inferring emotions is banned.

Risk classification

Jurisdiction	Level	Date	Note
Brazil	Data protection	—	LGPD: purpose, necessity and transparency; bill PL 2338 would ban emotion recognition at work.

Obligations related to this use case

Data protection impact report (RIPD)

LGPDLGPD, arts. 10 §3 y 38In force

Already applicable

When it relates: If you carry out high-risk processing: automated decisions, biometrics, sensitive or children's data, monitoring or model training.
What the rule provides: Have the RIPD ready to hand over when the ANPD requests it.
Follow ANPD guidance (2023), which lists solely automated decisions among high-risk criteria; the specific regulation is still pending.
Typical evidence: Dated RIPD per system.
Related base documents: Data Protection Impact Assessment (DPIA) for AI
Supporting documents: Algorithmic Impact Assessment (AIA)
Impact Assessment Summary Register
Verification: Verified in the official source on November 4, 2026Checked against the consolidated text of Law 13,709/2018 published by the Chamber of Deputies (Legislação Informatizada), arts. 10 § 3 and 38 (the ANPD may request the RIPD). That the specific RIPD regulation is still pending comes from the ANPD agenda and secondary sources (Mattos Filho, Confidata). Planalto did not respond in this review.

Appoint and publish the data protection officer

ANPD Res. 18/2024 (DPO)LGPD, art. 41; Res. CD/ANPD 18/2024, arts. 3, 8 a 10 y 18In force

Already applicable

When it relates: If you are not a small-scale agent, or if you are but carry out high-risk processing (sensitive data, automated decisions, biometrics, monitoring).
What the rule provides: Formally appoint the officer and publish their identity and contact details on the website.
Give them autonomy, resources and access to senior management; avoid conflicts of interest.
Typical evidence: Appointment act and website disclosure.
Related base documents: Data Protection Officer Appointment Record
Verification: Verified in the official source on November 4, 2026Checked against the LGPD (art. 41, Chamber of Deputies text) and the text of CD/ANPD Res. 18/2024 published by the ANPD on gov.br: art. 3 (formal appointment), 9 (publish identity and contact on the website), 10 (resources and technical autonomy) and 18 (conflict of interest).

Related kits

Includes 5 documents

HR and AI Recruiting Kit

AI hiring policy, notice to workers and representatives, meaningful human oversight, DPIA and decision review for candidates and employees.

USD 129USD 215

Complete kit · available to buy