Brazil's AI rules: LGPD Article 20 and the AI Bill (PL 2338/2023)

What it is

Brazil regulates AI today through its data protection law, and is working on a dedicated AI law. This page covers both.

LGPD Article 20. The Lei Geral de Proteção de Dados Pessoais, Law 13.709 of 14 August 2018, is Brazil’s general data protection law. Article 20 gives data subjects the right to request review of decisions taken solely on the basis of automated processing of personal data that affect their interests. That expressly includes decisions that define a person’s personal, professional, consumer or credit profile, or aspects of their personality. The LGPD came into force on 18 September 2020, and it is enforced by the Autoridade Nacional de Proteção de Dados (ANPD).

PL 2338/2023, the AI Bill. Presented in the Senate in May 2023 by Senator Rodrigo Pacheco, the bill provides for the development, promotion and ethical and responsible use of artificial intelligence, centred on the human person. The Senate approved a substitute text, reported by Senator Eduardo Gomes, on 10 December 2024. The Chamber of Deputies received it on 17 March 2025, and a special committee on artificial intelligence is considering it, with Deputy Aguinaldo Ribeiro designated rapporteur on 20 May 2025.

Who it applies to

Article 20 applies to any controller subject to the LGPD whose decisions about people are made solely by automated processing of personal data. Under Article 3, the LGPD applies to processing carried out in Brazil, processing aimed at offering goods or services to, or processing the data of, people located in Brazil, and processing of personal data collected in Brazil, whatever the country where the controller is based.

Responsibility stays with the controller. An organisation that uses a vendor’s model to approve credit, rank job applicants or set prices for individuals in Brazil must be able to answer a review request and explain the criteria, even if the model belongs to someone else.

As approved by the Senate, PL 2338/2023 would apply to developers, distributors and deployers of AI systems. It excludes private, non-economic use, national defence, and research and testing before a system is released.

What it requires

LGPD Article 20 now

• Review on request. A person can ask for review of a solely automated decision that affects their interests. The 2018 text required review by a natural person. Law 13.853 of 2019 removed those words, and a new paragraph that would have restored them was vetoed, so the law no longer says expressly that a human must carry out the review.
• Explanation on request. The controller must give clear and adequate information about the criteria and procedures used for the decision whenever asked, while respecting commercial and industrial secrecy (Article 20(1)).
• Audit where secrecy is claimed. If the controller declines to give that information on secrecy grounds, the ANPD may audit the automated processing for discriminatory aspects (Article 20(2)).

Article 20 sits inside the wider LGPD. A legal basis is needed for the processing, the transparency and data subject rights apply, and the ANPD can sanction breaches. Fines run up to 2 per cent of the entity’s revenue in Brazil, capped at R$50 million per infraction, and the sanction articles have applied since 1 August 2021.

PL 2338/2023 as approved by the Senate

• Preliminary risk assessment. Agents carry out a preliminary assessment before a system is placed on the market. It is mandatory for generative AI, and the competent authority can revise the classification.
• Excessive risk. Some uses are prohibited, such as systems that instigate behaviour harmful to fundamental rights, systems that rank people for access to public policies, and autonomous weapons.
• High risk. Systems such as those controlling access to essential services, medical diagnosis and procedures, and autonomous vehicles carry extra duties. These include an algorithmic impact assessment, documentation, testing, bias mitigation and a defined degree of human oversight.
• Rights. People would have the right to know they are interacting with AI, to an explanation of decisions, to protection from unlawful or abusive discrimination, and, for high-risk systems, to contest decisions and seek human review.
• Generative AI and copyright. Synthetic content must be identifiable, and use of protected works must be disclosed, with rights holders able to object and be paid.
• Governance. A national AI regulation and governance system (SIA) would be coordinated by the ANPD as competent authority, working with sector regulators.

The Chamber may change any of this before a vote.

Key dates

• 14 August 2018. LGPD enacted.
• 18 September 2020. LGPD in force, including Article 20.
• 1 August 2021. ANPD’s administrative sanction powers (Articles 52 to 54) in force.
• 10 December 2024. Senate approves PL 2338/2023.
• 17 March 2025. Chamber of Deputies receives the bill.
• 20 May 2025. Rapporteur designated in the Chamber’s special committee.

There is no scheduled vote. The bill’s progress can be followed on the Chamber’s tracker for PL 2338/2023.

How it relates to other frameworks

Article 20 is narrower than GDPR Article 22. The GDPR restricts solely automated decisions with significant effects, while the LGPD lets them happen and gives people a right to have them reviewed and explained. South Africa’s POPIA section 71 sits closer to the GDPR model.

PL 2338/2023 follows the EU AI Act’s shape, with prohibited practices, a high-risk tier and duties on generative AI, and adds an algorithmic impact assessment that resembles the fundamental rights impact assessment in the AI Act. An organisation already running AI risk and impact assessments under the AI Act, ISO/IEC 42001 or ISO/IEC 42005 will find most of the bill’s documentation duties familiar if it becomes law.

A note on this page

This is Aicura’s reading of the LGPD and of the Senate-approved text of PL 2338/2023. It is not legal advice and it is not the law itself. Read the primary sources on the Planalto and Chamber of Deputies sites, and take advice on how Brazilian law applies to your organisation.