Skip to content
AI Policy Generator

ESWhat applies

Training or fine-tuning models on own data in Brazil: related rules

Training, fine-tuning or grounding models on customer, employee or public data. It requires a legal basis to reuse personal data, dataset documentation and, when developing a general-purpose model, provider duties.

Risk classification

JurisdictionLevelDateNote
BrazilData protection—LGPD; the ANPD prioritizes AI in 2026-2027.

Obligations related to this use case

Data protection impact report (RIPD)

LGPDLGPD, arts. 10 §3 y 38In force

Already applicable

When it relates
If you carry out high-risk processing: automated decisions, biometrics, sensitive or children's data, monitoring or model training.
What the rule provides
  • Have the RIPD ready to hand over when the ANPD requests it.
  • Follow ANPD guidance (2023), which lists solely automated decisions among high-risk criteria; the specific regulation is still pending.
Typical evidence
  • Dated RIPD per system.
Verification
Verified in the official source on November 4, 2026Checked against the consolidated text of Law 13,709/2018 published by the Chamber of Deputies (Legislação Informatizada), arts. 10 § 3 and 38 (the ANPD may request the RIPD). That the specific RIPD regulation is still pending comes from the ANPD agenda and secondary sources (Mattos Filho, Confidata). Planalto did not respond in this review.

Appoint and publish the data protection officer

ANPD Res. 18/2024 (DPO)LGPD, art. 41; Res. CD/ANPD 18/2024, arts. 3, 8 a 10 y 18In force

Already applicable

When it relates
If you are not a small-scale agent, or if you are but carry out high-risk processing (sensitive data, automated decisions, biometrics, monitoring).
What the rule provides
  • Formally appoint the officer and publish their identity and contact details on the website.
  • Give them autonomy, resources and access to senior management; avoid conflicts of interest.
Typical evidence
  • Appointment act and website disclosure.
Verification
Verified in the official source on November 4, 2026Checked against the LGPD (art. 41, Chamber of Deputies text) and the text of CD/ANPD Res. 18/2024 published by the ANPD on gov.br: art. 3 (formal appointment), 9 (publish identity and contact on the website), 10 (resources and technical autonomy) and 18 (conflict of interest).

Related base documents

Related kits

Includes 7 documents

Self-Hosted and Open-Weight Models Kit

Seven base documents for hosting in-house or open-weight models: provenance, security baseline, adversarial testing, architecture, model card, life cycle and rollback.

USD 149USD 233

Complete kit · available to buy

Find out what applies to you (free)Brazil