Skip to content
Back to Destinations

Brazil: compliance overview

2 regulations, 8 mapped obligations and 1 data-transfer routes, organised by when they start to bind you and what you have to do.

Filter the obligations that bind usContact an advisor

Regulatory timeline: what comes next

  1. 2025-03-17

    Sent to the Chamber of Deputies for revision and registered there

    Brazilian AI Bill PL 2338/2023 (not yet law)

  2. 2025-04-29

    The Chamber’s Special Committee is constituted

    Brazilian AI Bill PL 2338/2023 (not yet law)

  3. 2026-09-02

    Verified status: still “awaiting the rapporteur’s opinion” in the Chamber, subject to Plenary consideration, and not law

    Brazilian AI Bill PL 2338/2023 (not yet law)

  4. 2026-09-12

    Verified: the ANPD is actively enforcing and is running an AI regulatory sandbox and related research

    Brazilian General Personal Data Protection Law (LGPD)

Applicable regulations (2)

In forceData & privacyRelevance High

Brazilian General Personal Data Protection Law (LGPD)

Article 3 defines scope along three routes, regardless of the processing agent’s seat or where the data is located: (I) the processing operation is carried out in Brazilian territory; (II) the processing activity has the purpose of offering or supplying goods or services to, or processing the data of, individuals located in Brazil (this limb was confirmed by Lei nº 13.853/2019 and its current wording is unchanged from the original); and (III) the personal data was collected in Brazilian territory — with §1 deeming data collected in Brazil where the data subject was in Brazil at the time of collection. Typical triggers: publishing an app or model API to Brazilian users and collecting account and behavioural data; opening a branch or hiring locally; providing labelling, training or inference services to Brazilian corporate customers; selling camera-, microphone- or location-enabled hardware through a Brazilian distributor that streams data back; and exporting Brazilian user data for model training, which must land on one of the five Article 33 routes.

6 obligations · reviewed 2026-09-12

ProposedAI regulationRelevance High

Brazilian AI Bill PL 2338/2023 (not yet law)

Important: this bill is not law, and what follows is not a current obligation — it is for readiness and investment diligence only. If enacted in the Senate-approved form, three things bite hardest for a Chinese AI company. (1) A “developer” placing a general-purpose or generative model on the Brazilian market must carry out a preliminary assessment and identify systemic risk; where systemic risk is present, before commercial release it must also produce a model description, documentation of risk tests and analyses, a record of residual non-mitigable risks, evidence that training datasets were lawfully collected and adequately governed, and a published training dataset summary — closely isomorphic to the EU AI Act’s general-purpose model duties, so one technical documentation set can serve both. (2) The final Article 13 excessive-risk list will determine outright whether some products can enter Brazil at all. (3) Article 1(1) excludes research, testing and development activities carried out before a system is placed on the market or put into service (testing in real conditions still follows the Law), leaving room for local validation work. Article 1(1) also excludes purely personal non-economic use, use solely for national defence, and services limited to providing storage and transport infrastructure for data used in AI systems.

2 obligations · reviewed 2026-09-12

Data transfer routes

  • Brazil LGPD international data transfer (Arts. 33-36)

    No volume threshold - Art. 33 applies to any transfer of personal data out of Brazil, which must fall within one of its listed grounds. The 2026 development: per the European Commission adequacy page as captured on 12 Sep 2026, the EU and Brazil adopted mutual adequacy decisions (the EU-side document dated 26 Jan 2026, announced jointly on 10 Feb 2026), described by the Commission as creating the biggest area of free and safe data flows in the world. For a Chinese company the practical meaning is that EU-Brazil flows are simplified by the mutual recognition while China-Brazil flows are not, so Chinese entities still rely on the contractual, global corporate rules or certification routes in Art. 33(II). This pass could not retrieve the text of ANPD’s standard contractual clauses regulation from an official source, so its clause structure, transition period and any requirement to submit to ANPD are unverified; confidence is therefore medium.

    Lead time: Estimate: 3-6 weeks for the contractual route including aligning with the ANPD clause text and preparing the technical and organisational measures narrative; the global corporate rules route requires verification by the national authority and its timeline was not verified in this pass, so assess it per project. · Cost band Medium

Sources (5)

Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.

GDPR · PIPL · CCPA control mapping
Traceable AI · cited when sourced
ISO 27001 alignment in progress
WCAG 2.1 AA accessibility target
Brazil: compliance overview | HaiWen HQ