← Global Privacy Laws Research Library
13.709/2018
Lei Geral de Proteção de Dados Pessoais
Lei Geral de Proteção de Dados Pessoais: LGPD: Brazil
Prepared by Shubhank Suman · Last reviewed
CURRENT
- Legal character
- Federal law
- Region
- Latin America
What it covers
LGPD regulates:
- personal-data processing
- sensitive personal data
- lawful bases
- data-subject rights
- controllers/processors
- DPO
- processing records
- government processing
- international transfers
- security
- incident response
- governance programmes
- sanctions.
Why it matters
LGPD is particularly important for AI because Article 20 expressly addresses automated decisions.
The statute is therefore much more than a generic privacy law for AI/data research.
AI, privacy and cybersecurity relevance
- AI: Very High
- Privacy: Very High
- Cyber: Very High
AI
VERY HIGH
The core AI provision is Article 20.
AI systems for:
- recruitment
- credit scoring
- insurance
- consumer profiling
- behavioural scoring
may therefore require careful analysis under the LGPD.
Cybersecurity
VERY HIGH
Articles 46–49 establish security and governance measures.
Applicability
Public/private organisations processing personal data within LGPD's territorial criteria.
Current validity
CURRENT.
Brazil continues to publish and maintain the consolidated law through official government sources. (Serviços e Informações do Brasil)
Read first
Articles 5–8 → Articles 17–20 → Article 20 → Articles 33–40 → Articles 46–52.
Provisions / sections covered
Article 5: Definitions
Includes:
- personal data
- sensitive personal data
- anonymisation
- controller
- processor
- DPO
- processing.
Articles 6–7
Processing principles and legal bases.
Article 8
Consent.
Articles 17–18
Data-subject rights.
Article 20: Automated decisionmaking
The data subject has a right to request review of decisions taken solely on the basis of automated processing that affect their interests, including decisions concerning:
- personal profile
- professional profile
- consumer profile
- credit profile
- personality characteristics.
The current consolidated official text confirms Article 20's automated-decision provision. (Planalto)
Articles 33–36
International transfers.
Articles 37–40
Processing records, DPO/controller/processor governance.
Articles 46–49
Security and good-practice measures.
Article 52
Administrative sanctions.
Subject-matter tags
- Consent
- Sensitive data
- Data subject rights
- Profiling
- Automated decision-making
- Cross-border transfers
- Data protection officer
- Controller and processor
- Enforcement and penalties
- Anonymisation
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.