Brazil's LGPD and Automated Decision-Making Provisions

Brazil already has an operative rule on automated decisions, and it does not depend on the fate of any AI bill. It looks like GDPR Article 22 at first glance and behaves differently in the single respect that matters most to how you build the review process.

What Article 20 says

The Lei Geral de Proteção de Dados Pessoais, Law No. 13,709 of 14 August 2018, has applied since 2020, with administrative sanctions available from August 2021. Article 20 is its provision on automated decisions. The consolidated official text is published by the Presidency: Lei nº 13.709/2018 on Planalto.

Article 20 gives the data subject the right to request review of decisions taken solely on the basis of automated processing of personal data that affect their interests, expressly including decisions intended to define a personal, professional, consumer or credit profile, or aspects of their personality. Paragraph 1 requires the controller to provide, whenever requested, clear and adequate information about the criteria and procedures used in the automated decision, subject to commercial and industrial secrecy. Paragraph 2 empowers the national authority to carry out an audit to verify discriminatory aspects in automated processing where the controller does not provide that information.

The human reviewer that was removed

This is the part that most cross-border summaries get wrong, and the history explains why.

As originally enacted in 2018, Article 20 gave a right to review by a natural person. That wording was removed while the LGPD was still in its vacatio period: a provisional measure that restructured parts of the statute and created the ANPD was converted into Law No. 13,853 of 2019, and in the process the words requiring the reviewer to be a natural person came out. An attempt to restore an explicit human-review requirement was not carried into the final text.

The result is a right to review without a statutory guarantee that a person performs it. Brazilian scholarship and practitioner commentary are divided about how much this changes: one reading is that a review conducted by another automated process satisfies the letter of the Article; another is that a review which is itself solely automated cannot meaningfully be a review of a solely automated decision, and that the LGPD’s general principles—good faith, transparency, non-discrimination and prevention—pull towards human involvement in substance if not in name.

It is not settled. There is no authoritative ANPD position resolving it as of this writing, and the point is a live one in Brazilian legal literature. What would settle it is either an ANPD regulation or enforcement decision on Article 20, or an appellate decision on a review that a controller conducted automatically. Until one of those arrives, the honest statement to a Brazilian counterparty is that the requirement is contested rather than absent.

Against that, the GDPR position is comparatively settled: Article 22 turns on whether there is meaningful human involvement, and a rubber-stamp does not count—see what meaningful human involvement requires and how “solely automated” is defined. A controller subject to both regimes will design to the European standard, because it is the stricter one on this specific point and satisfies both.

Explanation, limited by trade secrets

Paragraph 1’s duty to explain the criteria and procedures is expressly qualified by commercial and industrial secrecy, and that qualification is broader on its face than anything in the GDPR’s corresponding provisions. Paragraph 2 is the counterweight: where the controller withholds information on secrecy grounds, the ANPD may audit for discriminatory effects.

That is an interesting design and worth understanding as a mechanism rather than as a rule. It does not resolve the tension between explanation and secrecy in the data subject’s favour; it relocates it to a regulator that can look inside under confidentiality. For a controller, the operational consequence is that invoking trade secrecy is not a costless refusal—it converts a disclosure request into potential regulatory attention.

When the right is triggered

Three conditions have to hold, and each of them narrows the field.

• Personal data. The LGPD applies to processing of personal data. A model output that involves no personal data is outside Article 20 entirely, whatever else it may implicate.
• Solely automated. A decision with genuine human input in the decision loop is not caught. As with the European provision, the question is whether the human contributes to the outcome or records it.
• Affecting the data subject’s interests. Article 20 uses a broad formulation and then gives profiling examples. Credit, employment and consumer profiling are squarely within it; a low-stakes personalisation may not be.

Territorially, Article 3 of the LGPD reaches processing carried out in Brazil, processing aimed at offering goods or services to individuals in Brazil, and processing of data collected in Brazil. A foreign provider with Brazilian users does not escape by having no Brazilian entity.

What this means for a deployment

Concretely, an automated decision system touching Brazilian individuals needs three things that are cheaper to build than to retrofit: a documented route by which an affected person can request review and get an answer, a written description of the criteria and procedures that can be handed over without exposing anything genuinely secret, and a record of what the system decided and on what inputs, so that a review has something to review.

The record is the piece most often missing. A review right is unusable against a system that cannot reconstruct why it produced a given output for a given person on a given date, and reconstructing it after the fact from a model that has since been updated is generally impossible. The same logic drives what counts as compliance evidence in every regime that grants a contestation right.

Finally, keep Article 20 separate in your head from the bill. Coverage of Brazil frequently blends the two, attributing PL 2338’s explanation and contestation rights to current law. Those rights are in a text that has been approved by one chamber and are not yet in force; Article 20 is.