How it works
LGPD is Brazil's General Personal Data Protection Law, enacted by Law No. 13,709 of August 14, 2018. It sets rules for personal data processing operations, including digital means, by public and private organizations, according to its scope and applicable hypotheses. The official text can be consulted on the Presidency of the Republic Legislation Portal.
The law sets out responsibilities and concepts such as data subject, controller and processor. In general terms, the data subject is the person the data refers to; the controller decides on the processing; and the processor handles data following instructions and responsibilities applicable to the controller. The same organization can play different roles depending on the activity.
LGPD also sets out principles for processing, data subject rights, legal bases and security requirements. This means an organization should not collect data "just in case" without defining purpose and legal basis. The process must consider necessity, transparency, quality, security and accountability, among other aspects provided by law.
Processing includes actions such as collecting, consulting, using, storing, sharing or deleting personal data. When using an AI tool, for example, sending a document to the service may constitute processing, depending on context. It is necessary to identify the data involved, the purpose, the participants in the flow and the vendor's conditions.
Practical example
A company wants to use an assistant to summarize support requests. Before starting, it identifies whether the messages contain personal data, defines the purpose of the summary, checks which legal basis applies and determines who can access inputs and outputs.
The team then reviews the vendor contract and settings, limits the data sent to what is necessary, defines retention and disposal and prepares a channel to respond to data subject requests when relevant. If a test version can use fictitious data, that alternative reduces exposure during validation.
The flow is not automatically compliant just because the tool has encryption or because data is processed by a well known vendor. The organization needs to understand its roles, document decisions and assess risks. Questions about specific obligations should be addressed with legal or privacy counsel.
What it is for
LGPD is meant to establish rights and duties related to personal data processing in Brazil. For businesses, it helps structure processes for collection, use, sharing, storage and response to requests. For individuals, it provides rights that can be exercised under the law and applicable rules.
In AI projects, the law is relevant when personal data enters prompts, training datasets, logs, evaluations or results. The team should map the full flow, avoid unnecessary data, clarify purposes and verify specific obligations, including those that depend on sector or situation.
This glossary provides an introductory explanation, not a legal analysis of a specific case. The official legal text, applicable regulation and professional guidance should be consulted to make decisions about a specific operation.