Brazil LGPD and the AI Compliance Posture for Companies Selling to LATAM

Brazil's LGPD and the AI Compliance Posture for Companies Selling into LATAM

If you're selling software or AI-powered services into Latin America, Brazil is almost certainly your largest target market. It's the fifth most populous country on the planet, with a GDP north of $2 trillion, and its data protection regime is more mature than most people outside the region realize. The Lei Geral de Proteção de Dados (LGPD, Law No. 13,709/2018) has been fully enforceable since August 2021, and the Autoridade Nacional de Proteção de Dados (ANPD) has been steadily building out its regulatory infrastructure. For companies deploying AI in regulated verticals, the compliance picture is getting more specific and more consequential.

ANPD's Evolving Stance on AI

The ANPD published its preliminary analysis of Brazil's proposed AI regulation (PL 2338/2023) in July 2023, and followed up with a second technical note in March 2024. Both documents make clear that the ANPD expects to play a central role in AI governance, particularly where automated decision-making intersects with personal data processing. This isn't hypothetical positioning. The ANPD has been explicit that LGPD Articles 6, 7, 12, and 20 already apply to AI systems processing personal data, even before any dedicated AI law passes.

Article 20 is the one that gets the most attention, and rightly so. It gives data subjects the right to request review of decisions made solely through automated processing that affect their interests. This includes credit scoring, insurance underwriting, hiring algorithms, and similar use cases. The original text of Article 20 required that review be conducted by a "natural person," but a presidential veto removed that requirement before enactment. So the review can itself be automated, at least in theory. In practice, the ANPD's guidance suggests that meaningful review requires more than running the same algorithm again. There's a real expectation of substantive human oversight, especially in high-impact contexts.

PL 2338/2023, the AI bill currently working through Brazil's Senate, would formalize a risk-based classification system similar to the EU AI Act. High-risk AI systems would face impact assessment requirements, transparency obligations, and human oversight mandates. The bill designates the ANPD as a key supervisory body for AI systems that process personal data. It passed the Senate in December 2024 and is now under consideration in the Chamber of Deputies. Even if the final text changes, the direction is clear: Brazil is building a layered regulatory model where LGPD serves as the data protection foundation and AI-specific rules sit on top.

Data Subject Rights Under LGPD: What AI Vendors Need to Know

LGPD's data subject rights framework (Articles 17 through 22) is broadly similar to GDPR, but there are differences that matter for AI deployments.

• Right to explanation (Article 20): Data subjects can request "clear and adequate information regarding the criteria and procedures used for automated decisions." If you're deploying a model that influences outcomes for Brazilian individuals, you need to be able to explain what the model does in terms a non-technical person can understand. Black-box models are a liability.
• Right to data portability (Article 18, V): Unlike GDPR, LGPD's portability right isn't limited to data provided by the subject. The ANPD's 2022 regulatory agenda flagged portability as a priority, and the implementing regulation (published in November 2023 via Resolution CD/ANPD No. 15) clarified that portability applies to personal data processed by the controller, with some exceptions for trade secrets and intellectual property.
• Right to deletion (Article 18, VI): Controllers must delete personal data processed with consent when the subject requests it. For AI systems, this raises the familiar question of model retraining. If personal data was used to train a model and the subject requests deletion, does the model itself need to be retrained? The ANPD hasn't issued definitive guidance on this yet, but the direction of travel in both Brazil and the EU suggests that "approximate unlearning" arguments will face increasing scrutiny.
• Data Protection Impact Assessments (Article 38): The ANPD can require a controller to produce a DPIA for processing that poses risks to civil liberties and fundamental rights. AI-driven processing of personal data in healthcare, finance, or employment will almost certainly trigger this requirement. The ANPD published its DPIA regulation (Resolution CD/ANPD No. 4) in early 2024, formalizing the methodology and documentation expectations.

The Practical Compliance Picture

Enforcement has been measured but real. The ANPD issued its first administrative sanction in July 2023, fining Telekall Infoservice for LGPD violations including failure to appoint a Data Protection Officer and failure to demonstrate a lawful basis for processing. The fine was modest (BRL 14,400, roughly $2,900 at the time), but the signal mattered more than the amount. Since then, the ANPD has opened dozens of administrative proceedings and published several preventive guidance documents.

The maximum fine under LGPD is 2% of a company's revenue in Brazil, capped at BRL 50 million per infraction (approximately $10 million). For a multinational selling AI services into Brazil, the revenue calculation is based on Brazilian operations, not global revenue. But reputational risk and contract-level consequences often outweigh the fine itself, especially in regulated verticals like healthcare (where ANVISA adds its own layer) and financial services (where the Central Bank's Resolution No. 4,893 on cybersecurity and Resolution No. 6 on open finance create overlapping obligations).

A few practical considerations for AI vendors entering the Brazilian market:

• Data localization: LGPD doesn't mandate data localization, but international data transfers are restricted under Articles 33 through 36. The ANPD approved standard contractual clauses (Resolution CD/ANPD No. 19, published August 2024) that function similarly to EU SCCs. If your AI system processes data on infrastructure outside Brazil, you need a valid transfer mechanism in place.
• DPO requirement: Every controller and processor must appoint a Data Protection Officer (Encarregado). The ANPD relaxed this requirement slightly for small businesses and startups via Resolution CD/ANPD No. 2 (January 2022), but if you're a mid-market or enterprise vendor, you need a named DPO with published contact information.
• Consent management: Consent under LGPD must be free, informed, and unambiguous, and it must be specific to the purpose. Broad consent for "AI training" is unlikely to hold up. If you're processing personal data to train or fine-tune models, you need granular consent or a different lawful basis (legitimate interest is available under Article 7, IX, but requires a balancing test and documentation).
• Portuguese-language obligations: Privacy notices, consent mechanisms, and data subject request channels need to be available in Portuguese. This is easy to overlook and surprisingly common as a compliance gap.

Cross-Border Complexity in LATAM

Brazil's LGPD is the most developed data protection framework in Latin America, but it doesn't exist in isolation. Argentina's Personal Data Protection Law (Law 25,326) is under revision, Colombia's Law 1581 of 2012 has its own enforcement body (the SIC), and Chile passed a major reform to its data protection law in December 2024. If you're building a LATAM go-to-market strategy, you're dealing with at least three or four distinct regulatory regimes, each with different requirements for AI transparency, data subject rights, and cross-border transfers. The temptation is to build for GDPR and assume it covers everything. It doesn't. LGPD's legitimate interest framework, its approach to anonymization (Article 12), and its sectoral overlaps with Brazilian financial and health regulators all create compliance requirements that a GDPR-only posture will miss.

How FirmAdapt Addresses This

FirmAdapt's architecture is built around the assumption that regulated companies operate across multiple jurisdictions with overlapping and sometimes conflicting requirements. For LGPD specifically, FirmAdapt's compliance layer maps data processing activities to LGPD's lawful bases, automates data subject request workflows (including Article 20 explanation requests for automated decisions), and generates DPIA documentation aligned with the ANPD's Resolution CD/ANPD No. 4 methodology.

For companies selling AI-powered products into Brazil and the broader LATAM market, FirmAdapt provides jurisdiction-specific compliance configurations that account for the differences between LGPD, GDPR, and other regional frameworks. The platform maintains audit trails for model training data provenance, consent records, and cross-border transfer mechanisms, which are the specific artifacts that regulators and enterprise procurement teams ask for when evaluating AI vendors in regulated industries.