LGPD and personal data in AI
Short answer Under Brazil’s LGPD (Lei Geral de Proteção de Dados, Law No. 13,709/2018), personal data used in AI systems must comply with all core principles—lawfulness, purpose limitation, necessity, transparency, and accountability—and requires a valid legal basis (e.g., consent or legitimate interest) for processing. Controllers must conduct Data Protection Impact Assessments (DPIAs) when AI…
The LGPD (Lei Geral de Proteção de Dados) applies to AI systems processing personal data of individuals in Brazil. Controllers must adhere to lawfulness, purpose limitation, necessity, transparency, and accountability principles for AI processing. A valid legal basis like consent or legitimate interest is required for data processing.
DPIAs are mandatory when AI processing poses high risk to data subjects' rights. Consent isn't the sole lawful basis; legitimate interest, contractual necessity, and legal obligation are also valid. The ANPD mandates specific DPIA documentation standards, including for generative AI models using personal data. "Anonymized" data must be irreversibly non-identifiable, while pseudonymized data remains personal data and stays in scope.
Violations can incur fines up to 2% of a company's Brazilian revenue, capped at R$ 50 million per infraction. AI systems, including generative AI trained on personal data, must comply with LGPD obligations from data collection to deployment. Generative AI must uphold lawfulness, security, and, if outputs re-identify or infer sensitive attributes, obtain heightened safeguards and consent.
Any information related to an identified or identifiable natural person is considered personal data under LGPD.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
