Describe your business, leave with a checklist you can assign

Determine, activity by activity, a legal basis under Article 7 (personal data) or Article 11 (sensitive personal data), and give clear, adequate and conspicuous notice of the purposes, the form and duration of processing, the controller’s identity and contact details, with whom the data is shared and why, and the data subject’s rights and how to exercise them. Where consent is the basis it must be given in writing or by another means that demonstrates it, be specific to the purpose, and be withdrawable at any time by an equally easy procedure; consent relating to children’s data, sensitive data and international transfers must be obtained separately and prominently. AI products should note that using user input to train models is a different purpose from delivering the service and needs its own disclosure and basis.

Evidence: Mapping table of processing activities to legal bases; Versioned Portuguese-language privacy notice with effective dates; Technical records of consent capture and withdrawal (timestamp, version, scope); Product screenshots of the separate training-use notice and any opt-out

Data subjects may request review of decisions taken solely on the basis of automated processing that affect their interests, including decisions intended to define their personal, professional, consumer or credit profile or aspects of their personality. Note: the operative text (as amended by Lei nº 13.853/2019) dropped the original “by a natural person” qualifier, so the statute no longer expressly mandates human review — but Article 20 §1 requires the controller, whenever asked, to provide clear and adequate information about the criteria and procedures used in the automated decision, subject to commercial and industrial secrecy, and §2 provides that where the controller withholds that information on secrecy grounds the ANPD may carry out an audit to check for discriminatory aspects in the automated processing. Design for this up front: explainability outputs, a review ticket workflow, and records of review outcomes that can be reconstructed later.

Evidence: Automated decision inventory and impact assessment; Review request intake channel, ticket workflow and turnaround records; External explanation of the criteria and procedures, with reasoning for any trade-secret redactions; Sample review conclusions and overturned decisions

Article 33 permits international transfers only in nine cases (I–IX): (I) to countries or international organisations providing a degree of protection adequate to that in the Law, as determined by the ANPD; (II) where the controller offers and demonstrates guarantees of compliance with the principles, data subject rights and data protection regime of the Law, in the form of specific contractual clauses for a given transfer, standard contractual clauses, global corporate rules, or regularly issued seals, certificates and codes of conduct; (III) where necessary for international legal cooperation between intelligence, investigation and prosecution bodies under instruments of international law; (IV) where necessary to protect the life or physical safety of the data subject or a third party; (V) where the national authority authorises it; (VI) where the transfer results from a commitment made in an international cooperation agreement; (VII) where necessary to execute a public policy or a legal attribution of public service, published under Article 23(I); (VIII) where the data subject has given specific and highlighted consent to the transfer, informed beforehand of its international character and with that purpose clearly distinguished from others; and (IX) where necessary to meet Article 7(II) (compliance with a legal obligation), (V) (judicial, arbitral or administrative proceedings) or (VI) (protection of life or physical safety). For a Chinese AI company repatriating Brazilian user data for training, the realistic route is (II), backed by minimisation, encryption and access control; route (VIII) sets a high bar (separate, highlighted, with prior notice of the international character) and should not carry bulk training-data transfers.

Evidence: International transfer register (recipient, country, data categories, Article 33 route relied on); Executed contractual clauses or global corporate rules; Records of separate transfer-specific consent where that route is used; Evidence of supplementary technical measures (encryption, minimisation, access logs)

Open tool: Transfer Matrix

Under Article 48 the controller must notify the ANPD and the data subject of a security incident that may create relevant risk or damage to data subjects, within a reasonable period “as defined by the national authority” (see the deadline field on this obligation), with at least the nature of the affected data, information about the data subjects involved, the technical and security measures used, the risks related to the incident, the reasons for delay where notification was not immediate, and the measures taken or to be taken to reverse or mitigate the harm. Under Article 37 controllers and processors must keep records of the processing operations they carry out, especially when based on legitimate interests. AI companies should include prompt logs, vector stores and model checkpoints in the blast-radius assessment.

Evidence: Security incident response plan and ANPD notification template; Incident register and submission records, including reasons for any delay; Records of processing operations, including those based on legitimate interests; Blast-radius assessment checklist covering prompt logs, vector stores and model checkpoints

AI incident and serious incident reporting record (register plus report drafts)

The LGPD imposes heightened rules on children’s and adolescents’ data (Article 14): processing must be in their best interests, and children’s data generally requires specific and prominent consent from a parent or legal guardian. Recent ANPD enforcement puts minors at the centre: on the retrieval date its site announced a BRL 153.7 million fine against a platform for failures in protecting children’s and adolescents’ data, and reminded digital platforms to publish transparency reports by 17 September 2026 under the Digital Statute of the Child and Adolescent (ECA Digital). Companies bringing social, generative, companion or education AI products to Brazil should build age assurance and routing, parental consent, stricter defaults for minors, and assess whether the platform transparency reporting duty applies to them.

Evidence: Age assurance and routing design note and test report; Parental or guardian consent workflow and records; Documentation of default settings and content safety policy for minors; Applicability assessment for the ECA Digital transparency reporting duty

Appoint an officer under Article 41 as the point of contact for data subjects and the ANPD, and publish their identity and contact details (typically in the privacy notice and prominently on the site). The role covers receiving complaints and communications from data subjects and providing explanations and taking action, receiving communications from the ANPD and acting on them, and guiding employees and contractors on data protection practices. Where an offshore entity has no Brazilian establishment, it should still designate someone able to receive communications in Portuguese and publish the channel.

Evidence: Officer appointment document and role description; Screenshot of the published identity and contact details on the site or in the privacy notice; Log of communications handled from data subjects and the ANPD; Data protection training records for employees and contractors

Under Article 29 of the Senate-approved text, the developer of a general-purpose or generative AI system must, in addition to the relevant development documentation, carry out a preliminary assessment to identify its expected risk levels, including potential systemic risk, taking into account reasonably expected uses and the criteria in Section III of Chapter III. The readiness action now is to fold this assessment into the existing model release review, produce an assessment report template that will map onto the Brazilian framing, and share a single source document with the EU AI Act general-purpose model technical documentation to avoid duplicated work later.

Evidence: Preliminary assessment report template and a first trial assessment; List of reasonably expected uses and the basis for the risk determination; Internal criteria and conclusion on systemic risk; Field mapping against the EU general-purpose model technical documentation

ISO/IEC 42001 AI management system implementation and certification readiness checklist

Under Article 30 of the Senate-approved text, before making a systemic-risk general-purpose or generative AI system available or placing it on the market for commercial purposes, the developer must: describe the general-purpose AI model; document the tests and analyses performed to identify and manage reasonably foreseeable risks, as appropriate and technically feasible; document residual non-mitigable risks remaining after development; process and incorporate only datasets collected and handled in accordance with legal requirements and subject to adequate data governance, and, where personal data is involved, with Lei nº 13.709/2018 and Chapter II of this Law; publish a summary of the training dataset as regulated; design and develop the systems using applicable standards to reduce energy and resource use and waste and increase energy and overall system efficiency in the context of use; and produce intelligible technical documentation and instructions for use so that developers, distributors and applicators understand how the system works (item VII). Article 30 §1 is pointed: compliance is required regardless of whether the system is supplied as a standalone model, embedded in another AI system or product, under free and open-source licences, as a service, or through other distribution channels — which matters most to Chinese vendors releasing open-weight models. Article 30 §2 lets developers draw up or adhere to codes of good practice to demonstrate conformity. Readiness action: start producing training data provenance and licence chains, evaluation and red-team records, a residual risk register, technical documentation and instructions for use, and a publishable training data summary now, so the evidence is reconstructable when the law takes effect.

Evidence: Model description (architecture, capability boundaries, intended and prohibited uses); Risk testing and analysis records (red-teaming, evaluation suites and conclusions); Residual risk register with mitigation status; Training data provenance and licence evidence, plus a draft publishable training dataset summary; Technical documentation and instructions for use aimed at developers, distributors and applicators (Article 30(VII)); Design note on energy and resource efficiency and the standards relied on

Model CardData Card — datasheet for a training, validation or test dataset