Brazil’s LGPD is relevant whenever personal data is collected, entered into or produced by an AI workflow. A proposed dedicated AI law is not the same thing as an existing data-protection duty.
Map each processing operation
List the source of customer profiles, prompts, retrieved documents, model telemetry, output records and evaluation datasets. Record which actor determines each purpose and which vendor processes data on its behalf. “The data stays in the chatbot” is not an adequate description: support access, backups, sub-processors and downstream analytics may each be part of the actual processing arrangement.
Purpose and legal basis are not automatic
Brazil’s data protection principles require analysis of lawful purpose, necessity, transparency and security. Publicly accessible information is not universally free for unrelated AI training. A new use of records collected for customer support may require a fresh lawful-basis and compatibility assessment. Avoid claiming consent is always required or that legitimate interest automatically resolves every AI use.
Automated decision rights
ANPD identifies Article 20 as involving review requests for decisions based solely on automated personal-data processing that affect individual interests. A credit-screening score used to reject a person may raise different issues from a draft email. The ANPD’s October 2026 regulatory agenda lists further AI and automated-decision interpretations as ongoing work, not finished rules.
Practical implementation
Provide employee rules that prevent uploading raw personal records into unapproved AI services. Use minimization, access-scoped retrieval, redaction, documented retention and a procedure to correct data that appears in outputs. Provide a human pathway for affected customers to challenge decisions; log the underlying decision procedure rather than merely saving a chatbot transcript.
What not to overclaim
This overview does not decide whether a specific model vendor is a controller or processor in every deployment or whether a proposed Brazilian AI framework is enacted. Check current ANPD interpretations, sector obligations and actual contracts before enabling production data flows.
Sources & Further Reading
- ANPD regulatory agenda, updated 20 October 2026 — Brazilian National Data Protection Authority (ANPD).
- Rights of Data Subjects — Brazilian National Data Protection Authority (ANPD).
Jurisdiction/scope: Brazil; LGPD privacy law and evolving ANPD interpretation. This is educational information, not legal, medical or other professional advice. No hands-on product testing is claimed.