AI and LGPD: What Does a Company Need to Assess? The 8 Questions Before Using Personal Data with AI
By Pedro Sonda, dooop
The LGPD already applies to all AI use involving personal data. Before using personal data with AI, a company needs to answer eight questions: (1) what is its role (controller or processor); (2) what is the legal basis for processing; (3) whether the purpose is clear and only necessary data are used; (4) how data subjects are informed; (5) how data subjects’ rights are guaranteed, including review of automated decisions; (6) whether sensitive data are involved; (7) how data are protected and incidents handled; and (8) whether there is international data transfer. For higher-risk uses, a data protection impact report organizes and documents these answers.
Updated in October 2026. Cited regulations and bills may change; check current status before legal decisions.
This content does not replace legal advice.
The Context
| Fact | Source |
|---|---|
| The LGPD guarantees the data subject the right to request review of decisions made solely based on automated processing that affect their interests (art. 20) and requires security measures (art. 46) | LGPD |
| In July 2024, the ANPD ordered the precautionary suspension of using Brazilian users’ personal data to train Meta’s AI; use resumed with restrictions after the company met the authority’s requirements | Agência Gov, 2024 |
| Resolution CD/ANPD No. 19/2024 regulated international data transfers and approved standard contractual clauses, with up to 12 months to incorporate them into contracts | ANPD, 2024 |
| Bill 2338/2023, proposing specific AI rules and assigning a coordinating role to the ANPD, was approved by the Senate in December 2024 and is pending in the Chamber of Deputies | Chamber of Deputies |
Interpretation: The Brazilian authority already acts on AI based on the LGPD, and many AI tools process data outside Brazil. Compliance does not depend on the future AI law: it starts now.
dooop Framework: The 8 Questions
| # | Question | What to Check | LGPD Basis |
|---|---|---|---|
| 1 | What is our role? | Does the company decide on processing (controller) or process on behalf of another (processor)? And what about the AI provider? | Arts. 5 and 37 to 40 |
| 2 | What is the legal basis? | Contract execution, legitimate interest, consent, legal obligation, among others; legitimate interest requires assessment and transparency | Arts. 7 and 10 |
| 3 | Purpose and necessity | Is the AI use compatible with the informed purpose? Are only necessary data used? | Art. 6 |
| 4 | Transparency | Do data subjects know their data are processed with AI, for what purpose, and by whom? | Arts. 6 and 9 |
| 5 | Data subjects’ rights | Can we provide access, correction, deletion, and review of automated decisions? | Arts. 18 and 20 |
| 6 | Sensitive data | Are there health data, biometrics, racial origin, religion, political opinion, among others? | Art. 11 |
| 7 | Security and incidents | Are there access controls, logs, and an incident plan including communication to ANPD and data subjects when applicable? | Arts. 46 to 49 |
| 8 | International transfer | Does the tool process data outside Brazil? Under what legal mechanism? | Art. 33; Resolution CD/ANPD No. 19/2024 |
Typical Situations
| Situation | Points of Attention |
|---|---|
| Employee uses AI assistant with customer data | Approved tool, retention conditions, training use, international transfer, minimization |
| Customer service chatbot | Transparency about AI use, access to a human, security of conversation records |
| Resume screening or employee evaluation | Legal basis, biases, human review, right to review, sensitive data |
| Credit analysis or personalized pricing | Automated decision (art. 20), explanation of criteria, review |
| Training or tuning models with customer data | Purpose compatibility, legal basis, transparency, possibility of objection |
The Impact Report
For higher-risk uses, the personal data protection impact report (art. 38) compiles answers to the eight questions, identified risks, and adopted measures. Even when not requested by the ANPD, it is a way to document the assessment and demonstrate care. To assess other solution risks beyond data, see How to Assess the Risk of an Artificial Intelligence Solution.
Who Participates
| Role | Contribution |
|---|---|
| Data Protection Officer (DPO) | Data protection assessment; contact with data subjects and ANPD |
| Legal | Legal bases, contracts, international transfer |
| IT and Security | Technical controls, logs, tool configuration |
| Use Owner | Purpose, necessary data, review process |
What to Do Now
- Apply the 8 questions to AI uses in the inventory involving personal data.
- Review contracts with AI suppliers regarding role, retention, use for training, and international transfer; see How to Govern Artificial Intelligence Suppliers.
- Prepare an impact report for uses classified as high risk.
To integrate LGPD and AI governance, explore dooop’s AI Governance initiative.
Frequently Asked Questions
Does using AI with personal data require consent? Not necessarily. Consent is one legal basis; others like contract execution or legitimate interest may be appropriate depending on the case. The choice must be evaluated and documented.
Is a market AI tool a processor? In many cases, the supplier acts as a processor when processing data on behalf of the company. But if it uses data for its own purposes, such as training its models, the analysis changes. Contracts and configurations must clarify this.
Will the future AI law replace the LGPD in these cases? According to the text approved by the Senate, Bill 2338/2023 would complement the LGPD, not replace it. Data protection obligations remain in force.
Also Read
About dooop
dooop is a consultancy based in Caxias do Sul (RS) that prepares leaders and organizations to transform artificial intelligence into business capability through strategy, governance, and training.