The short answer
Brazil's data protection law, the LGPD (Law 13,709/2018), applies to artificial intelligence whenever the system processes personal data: reading, classifying, summarizing or sending to a model data that identifies someone is processing. The same rules as any system apply: a legal basis, a defined purpose, only the data needed, security and transparency toward the data subject.
What AI adds are its own points of attention: sending data to model providers, often outside the country, the use of sensitive data, such as health data, and automated decisions that affect people. This text is a practical guide, not a legal opinion. Each case should go through your organization's data protection officer (DPO) and legal team.
When the LGPD applies to the use of AI
The law protects personal data, that is, information related to an identified or identifiable natural person. Name, CPF (Brazilian taxpayer ID), email, phone, address and a customer's service history are personal data. A contract with the representative's name, an invoice issued to an individual and a WhatsApp message also carry personal data, even if the AI's task is only to extract an amount.
That is why the useful question is not whether the company uses AI, but what goes through it. An automation that reads inventory spreadsheets, with no data about people, falls outside the LGPD. An agent that reads the support team's inbox falls within it, because every message has a sender, a signature and, sometimes, much more delicate information.
Data anonymized in a way that makes it impossible, with reasonable effort, to trace it back to the person is no longer personal data under the law. Pseudonymizing, replacing the name with a code but keeping the key, reduces the risk, but the data is still personal.
The LGPD principles that matter most in AI projects
The law lists principles that apply to all processing. In projects with artificial intelligence, some call for more attention.
- Legal basis. All processing must rest on one of the grounds set out in the law, such as performance of a contract, compliance with a legal obligation, legitimate interest or consent. The basis that covers customer service does not automatically cover using the same data for another purpose.
- Purpose. Data can only be used for the purpose disclosed to the data subject. If the AI will use support data for something else, such as training a model or building a consumer profile, that needs to be assessed separately.
- Necessity, or minimization. The AI should receive only what the task requires. To classify a ticket by subject, the model does not need the CPF or the address of whoever wrote it.
- Transparency. Data subjects have the right to clear information about how their data is processed, which includes knowing when automated processing is involved.
- Security and prevention. Technical and administrative measures to prevent unauthorized access, leaks and use beyond what was agreed, planned before the incident, not after.
- Non-discrimination. Processing cannot be used for unlawful or abusive discriminatory purposes, a special concern when AI helps classify or prioritize people.
- Accountability. The organization must be able to demonstrate that it complies with the law, with records and documentation, and not just claim that it does.
Sensitive data, such as health data, calls for stricter rules
The LGPD defines as sensitive personal data information about racial or ethnic origin, religious belief, political opinion, membership in a union or in a religious, philosophical or political organization, health, sex life, genetic and biometric data. Processing this data has narrower legal grounds, and legitimate interest is not among them.
In practice, an AI project that reads medical records, test reports, sick notes or patient triage falls into the highest risk group. That does not rule the project out, but it calls for role-based access control, a log of every action, criteria for what can leave the environment and, in many cases, an impact assessment. In the patient management system we are building for an emergency care unit, access profiles, an audit trail and LGPD compliance are part of the scope from the start.
| Type of data | Examples | Risk | Minimum care before using AI |
|---|---|---|---|
| No personal data | Inventory, catalog prices, technical manuals | Low under the LGPD | Confidentiality agreements and usage rules for the tool |
| Anonymized or aggregated | Monthly totals, indicators without identification | Low, if the anonymization is real | Check that the person cannot be traced by cross-referencing other sources |
| Ordinary personal data | Name, email, phone, purchase history | Medium | Legal basis, minimization, restricted access and a record of processing |
| Financial or credit | Bank details, income, defaults | High, given the harm of a leak or an error | Human review of decisions and strong access control |
| Sensitive | Health, biometrics, religion, union membership | Very high | Specific legal ground, impact assessment, external sending only with an explicit rule |
| Children and adolescents | School records, services for minors | Very high | Processing in the best interest of the minor and review with the legal team |
Automated decisions and the right to review
Article 20 of the LGPD gives data subjects the right to request a review of decisions made solely on the basis of automated processing that affect their interests, including those that define their personal, professional, consumer and credit profile. The law also requires the controller to provide, upon request, clear information about the criteria and procedures used, subject to commercial and industrial secrecy.
This weighs on system design. If AI approves or rejects credit, screens résumés or sets service priority with no one in the loop, the company must be ready to explain the criteria and review the decision. A workflow in which the AI suggests and a person decides reduces that risk and, as a bonus, catches the model's mistakes before they become a problem. It is the design we adopt in automation and artificial intelligence: human review at decision points and a record of what the AI suggested and what was approved.
Sending data to an AI model provider
When a system uses a third-party language model, the text sent in the request leaves the company's environment and is processed on the provider's servers. From the LGPD's point of view, your organization generally remains the controller, the one that decides about the processing, and the provider acts as a processor. The responsibility for choosing well and contracting with adequate clauses remains yours.
Before sending personal data, it is worth checking the provider's terms to see whether the data sent is used to train models, how long it is kept, in which country it is processed and what security guarantees are offered. If processing happens outside Brazil, there is an international data transfer, which the LGPD only allows under specific grounds. Business plans usually have different conditions from free plans, and that difference needs to be in writing.
A good practice is to strip from the text, before sending it, what the task does not require: names, ID numbers, contact details. In many classification and extraction tasks, the model works as well with masked data as with the original. The article on AI agents for businesses shows how to limit what an agent can read.
Checklist before putting AI into production
Before connecting an AI automation to production data, these points should have a written answer, reviewed by the data protection officer and the legal team.
- Data map. Which personal data enters the workflow, where it comes from, who has access and how long it is kept.
- Legal basis and purpose. Which ground in the law supports the processing and whether the purpose is compatible with the one disclosed to the data subject.
- Minimization. What can be removed or masked before it reaches the model without hurting the task.
- Model provider. Terms of use, retention, training on the data sent, processing location and a contract with data protection clauses.
- Sensitive data. If it appears in the workflow, which specific legal ground applies and whether a data protection impact assessment is needed.
- Human review. Which decisions the AI only suggests, who approves and how the data subject can request a review of an automated decision.
- Records. A log of what was processed, what the AI suggested and who approved, to demonstrate compliance with the law and investigate errors.
- Security and incidents. Access control, protected credentials and a plan for what to do in case of a leak or misuse.
In our way of working, data protection and the LGPD are part of the design from the start, and client information only goes through authorized tools. If you are choosing which process to automate, the guide on how to automate processes with AI complements this checklist.