Brazil General Data Protection Law (LGPD): Automated Decision Review
Article 20 gives data subjects the right to request review of decisions made solely by automated processing that affect their interests. It is Brazil's operative AI constraint until its AI bill passes.
Key dates
- Sep 18, 2020Came into force
- Aug 1, 2021Administrative sanctions became applicable
Risk areas addressed
Who it applies to
Any organisation processing personal data of individuals in Brazil, including automated decision-making.
Penalties & enforcement
Up to 2% of Brazilian revenue, capped at R$50M per infraction.
Enforced by: Autoridade Nacional de Proteção de Dados (ANPD)
Brazil LGPD (Art. 20) is enforced by Autoridade Nacional de Proteção de Dados (ANPD). Its obligations are already live, so a gap is a present exposure rather than a future one. In practice that means knowing which of your AI systems fall in scope across every sector you operate in, holding assessments that speak to privacy, transparency and bias & discrimination, and being able to produce that evidence on request, including for systems built outside the jurisdiction.