Appoint and publish the data processing officer (encarregado)
Severity MediumLGPD Art. 41
Appoint an officer under Article 41 as the point of contact for data subjects and the ANPD, and publish their identity and contact details (typically in the privacy notice and prominently on the site). The role covers receiving complaints and communications from data subjects and providing explanations and taking action, receiving communications from the ANPD and acting on them, and guiding employees and contractors on data protection practices. Where an offshore entity has no Brazilian establishment, it should still designate someone able to receive communications in Portuguese and publish the channel.
- Applies when
- All controllers within the Article 3 scope.
- Evidence to retain
- · Officer appointment document and role description
- · Screenshot of the published identity and contact details on the site or in the privacy notice
- · Log of communications handled from data subjects and the ANPD
- · Data protection training records for employees and contractors
Estimated first-time effort: 2–5 person-days (estimate, not a commitment)
Establish a legal basis for each processing activity and give transparent notice
Severity HighLGPD Art. 7、Art. 8、Art. 9、Art. 11
Determine, activity by activity, a legal basis under Article 7 (personal data) or Article 11 (sensitive personal data), and give clear, adequate and conspicuous notice of the purposes, the form and duration of processing, the controller’s identity and contact details, with whom the data is shared and why, and the data subject’s rights and how to exercise them. Where consent is the basis it must be given in writing or by another means that demonstrates it, be specific to the purpose, and be withdrawable at any time by an equally easy procedure; consent relating to children’s data, sensitive data and international transfers must be obtained separately and prominently. AI products should note that using user input to train models is a different purpose from delivering the service and needs its own disclosure and basis.
- Applies when
- All controllers in scope, especially platforms that train or fine-tune models on user content.
- Evidence to retain
- · Mapping table of processing activities to legal bases
- · Versioned Portuguese-language privacy notice with effective dates
- · Technical records of consent capture and withdrawal (timestamp, version, scope)
- · Product screenshots of the separate training-use notice and any opt-out
Estimated first-time effort: 6–15 person-days (estimate, not a commitment)
Right to review of solely automated decisions and disclosure of the criteria
Severity HighLGPD Art. 20
Data subjects may request review of decisions taken solely on the basis of automated processing that affect their interests, including decisions intended to define their personal, professional, consumer or credit profile or aspects of their personality. Note: the operative text (as amended by Lei nº 13.853/2019) dropped the original “by a natural person” qualifier, so the statute no longer expressly mandates human review — but Article 20 §1 requires the controller, whenever asked, to provide clear and adequate information about the criteria and procedures used in the automated decision, subject to commercial and industrial secrecy, and §2 provides that where the controller withholds that information on secrecy grounds the ANPD may carry out an audit to check for discriminatory aspects in the automated processing. Design for this up front: explainability outputs, a review ticket workflow, and records of review outcomes that can be reconstructed later.
- Applies when
- Controllers running credit scoring, fraud blocking, pricing or limit decisions, CV screening or content actions in Brazil, and the vendors supplying the models.
- Evidence to retain
- · Automated decision inventory and impact assessment
- · Review request intake channel, ticket workflow and turnaround records
- · External explanation of the criteria and procedures, with reasoning for any trade-secret redactions
- · Sample review conclusions and overturned decisions
Estimated first-time effort: 6–15 person-days (estimate, not a commitment)
International transfers: select and evidence one of the nine Article 33 routes
Severity HighLGPD Art. 33
Article 33 permits international transfers only in nine cases (I–IX): (I) to countries or international organisations providing a degree of protection adequate to that in the Law, as determined by the ANPD; (II) where the controller offers and demonstrates guarantees of compliance with the principles, data subject rights and data protection regime of the Law, in the form of specific contractual clauses for a given transfer, standard contractual clauses, global corporate rules, or regularly issued seals, certificates and codes of conduct; (III) where necessary for international legal cooperation between intelligence, investigation and prosecution bodies under instruments of international law; (IV) where necessary to protect the life or physical safety of the data subject or a third party; (V) where the national authority authorises it; (VI) where the transfer results from a commitment made in an international cooperation agreement; (VII) where necessary to execute a public policy or a legal attribution of public service, published under Article 23(I); (VIII) where the data subject has given specific and highlighted consent to the transfer, informed beforehand of its international character and with that purpose clearly distinguished from others; and (IX) where necessary to meet Article 7(II) (compliance with a legal obligation), (V) (judicial, arbitral or administrative proceedings) or (VI) (protection of life or physical safety). For a Chinese AI company repatriating Brazilian user data for training, the realistic route is (II), backed by minimisation, encryption and access control; route (VIII) sets a high bar (separate, highlighted, with prior notice of the international character) and should not carry bulk training-data transfers.
- Applies when
- Controllers and processors moving Brazilian personal data out of Brazil, or giving offshore teams remote access to it.
- Evidence to retain
- · International transfer register (recipient, country, data categories, Article 33 route relied on)
- · Executed contractual clauses or global corporate rules
- · Records of separate transfer-specific consent where that route is used
- · Evidence of supplementary technical measures (encryption, minimisation, access logs)
Estimated first-time effort: 8–18 person-days (estimate, not a commitment)
Security incident notification and records of processing
Severity HighLGPD Art. 37、Art. 48
Under Article 48 the controller must notify the ANPD and the data subject of a security incident that may create relevant risk or damage to data subjects, within a reasonable period “as defined by the national authority” (see the deadline field on this obligation), with at least the nature of the affected data, information about the data subjects involved, the technical and security measures used, the risks related to the incident, the reasons for delay where notification was not immediate, and the measures taken or to be taken to reverse or mitigate the harm. Under Article 37 controllers and processors must keep records of the processing operations they carry out, especially when based on legitimate interests. AI companies should include prompt logs, vector stores and model checkpoints in the blast-radius assessment.
- Applies when
- All controllers and processors in scope.
- Deadline: Article 48 §1: within a reasonable period, “as defined by the national authority”. The statute itself fixes no number of hours, but the period is set by ANPD normative act; that act could not be retrieved in this review because the ANPD site was restricted for the electoral period. Confirm the deadline and filing channel in the ANPD’s current security incident regulation before relying on this — do not treat “a reasonable period” as self-determined.
- Evidence to retain
- · Security incident response plan and ANPD notification template
- · Incident register and submission records, including reasons for any delay
- · Records of processing operations, including those based on legitimate interests
- · Blast-radius assessment checklist covering prompt logs, vector stores and model checkpoints
Estimated first-time effort: 5–12 person-days (estimate, not a commitment)
Children’s data and platform transparency duties
Severity HighLGPD Art. 14
The LGPD imposes heightened rules on children’s and adolescents’ data (Article 14): processing must be in their best interests, and children’s data generally requires specific and prominent consent from a parent or legal guardian. Recent ANPD enforcement puts minors at the centre: on the retrieval date its site announced a BRL 153.7 million fine against a platform for failures in protecting children’s and adolescents’ data, and reminded digital platforms to publish transparency reports by 17 September 2026 under the Digital Statute of the Child and Adolescent (ECA Digital). Companies bringing social, generative, companion or education AI products to Brazil should build age assurance and routing, parental consent, stricter defaults for minors, and assess whether the platform transparency reporting duty applies to them.
- Applies when
- Consumer-facing AI products in Brazil that minors may use; platform services must additionally assess the ECA Digital transparency reporting duty.
- Evidence to retain
- · Age assurance and routing design note and test report
- · Parental or guardian consent workflow and records
- · Documentation of default settings and content safety policy for minors
- · Applicability assessment for the ECA Digital transparency reporting duty
Estimated first-time effort: 8–20 person-days (estimate, not a commitment)