Summary
- Right to review automated decisions (Art. 20): a person can ask for review of decisions taken solely by automated processing that affect their interests, including profiling for personal, professional, consumer or credit purposes. The current text no longer says the reviewer must be a human (the "by a natural person" wording was removed).
- Explanation (Art. 20, §1): on request, the controller must give clear information on the criteria and procedures used, protecting trade secrets.
- Algorithm audit (Art. 20, §2): if the controller withholds that information citing trade secrets, the ANPD may audit for discriminatory aspects.
- Lawful bases (Art. 7, and Art. 11 for sensitive data) apply to AI training and use like any processing; legitimate interest is available for ordinary data.
- ANPD is now an agency: the consolidated text renames it Agência Nacional de Proteção de Dados (via Provisional Measure 1.317/2025 and Law 15.352/2026; exact dates not checked). It is also the proposed coordinator of AI regulation under Brazil AI Bill (PL 2338/2023).
Who it applies to
- Any processing by public or private persons, regardless of where they are based or where data is stored, if processing happens in Brazil, aims to offer goods or services to people in Brazil, or concerns data collected in Brazil (Art. 3).
- All sectors. Credit scoring also has its own rules under Brazil's credit information law.
Key dates
- LGPD signed (Law 13.709/2018)
- ANPD provisions in force (Art. 65, I)
- Law 13.853/2019 amends Art. 20, removing the requirement that review be done by a natural person (date secondary)
- Most LGPD provisions in force (date secondary; Art. 65, II)
- Administrative sanctions (Arts. 52 to 54) enforceable (Art. 65, I-A)
Full date record
| Date | Event |
|---|---|
| 2018-08-14 | LGPD signed |
| 2018-12-28 | ANPD provisions in force |
| 2020-09-18 | Main provisions in force (secondary; Art. 65 says 24 months after publication, after a planned postponement was dropped) |
| 2021-08-01 | Sanctions enforceable |
| 2024 (July to August) | ANPD preventive measure suspending Meta's use of Brazilian users' data for AI training, then lifted after a compliance plan (secondary sources) |
Penalties and enforcement
- Art. 52: warning; fine up to 2% of Brazilian revenue, capped at R$ 50 million per infraction; daily fines; publicity; blocking or deletion; partial or total suspension of processing.
- ANPD has shown it will act against AI training practices (2024 Meta case, secondary). Consumer protection bodies and courts also enforce data rights.
What it means for an Indian company
- If you offer products to people in Brazil or process data collected there, the LGPD applies (Art. 3), even without a Brazilian entity.
- For credit, insurance, hiring or fraud models, build an Art. 20 review route and a way to explain criteria and procedures on request (SC-AI-027 Right to contest and human review for individuals, SC-AI-024 Explain AI-assisted decisions).
- Prepare for an ANPD audit if you refuse disclosure on trade secret grounds: keep bias test evidence ready (SC-AI-017 Fairness and discrimination testing of outputs, SC-AI-013 Data bias and representativeness checks).
- Document lawful bases for training and opt-out handling (SC-AI-011 Lawful basis and consent for personal data used in AI).
Obligations
Full obligation breakdown coming
We break the most requested policies down into numbered obligations mapped to controls. Leave your details and we’ll tell you when Brazil LGPD is done.
Glossary
- LGPD: Lei Geral de Proteção de Dados, Brazil's general data protection law.
- ANPD: Agência Nacional de Proteção de Dados, the national regulator.
- Controlador: the controller, who decides on processing.
- Encarregado: the data protection officer and contact point.
- Segredo comercial e industrial: trade and industrial secrets, which can limit disclosure.
- Medida Provisória: a temporary presidential measure with force of law, later converted by Congress.
Key takeaways
- Not AI-specific, but Art. 20 gives a right to review automated decisions and lets the ANPD audit algorithms for discrimination.
- Extraterritorial reach similar to the GDPR.
- Fines up to 2% of Brazilian revenue, max R$ 50 million per infraction, enforceable since 2021-08-01.
Official sources
- Lei nº 13.709/2018 (LGPD), consolidated text, Planalto, accessed 2026-10-19
- ANPD website (gov.br/anpd), not opened for this card; ANPD AI actions above are from secondary sources
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.