🇧🇷LGPDANPDBill 2338

AI governance in Brazil.

Brazil has Latin America's most active AI governance landscape. LGPD, a comprehensive GDPR-modelled privacy law, is in force and enforced. An AI Bill passed the Senate in December 2024 and is still waiting on a House special committee. Brazil set G20 AI principles during its 2024 Presidency. This is a jurisdiction in active development, not a blank slate.

Key facts for organisations

▸Brazil is the most active AI governance jurisdiction in Latin America, with LGPD in force, an AI Bill still before Congress, and a mature data protection authority.
▸The LGPD creates specific rights around automated decision-making: individuals can request review of decisions made solely by automated means that affect their interests, and organisations must give clear and adequate information about the criteria and procedures involved. Two limits matter. Article 20 does not require the review to be done by a human, because Congress upheld the veto of the natural-person requirement on 2 October 2019, and the information right is expressly subject to commercial and industrial secrecy.
▸Bill 2338, which the Brazilian Senate passed in December 2024, creates a risk-based AI framework with prohibited practices, conformity assessment for high-risk AI, transparency obligations, and liability rules. As of August 2026 it is still before a Chamber of Deputies special committee, awaiting the rapporteur's report.
▸Brazil is a member of the Global Partnership on AI (GPAI) and has engaged in international AI governance discussions, including the G20 AI principles under Brazil's 2024 G20 presidency.
▸Australian organisations with Brazilian customers, employees, or operations are subject to LGPD when processing personal data of individuals in Brazil, including through AI systems.
▸ANPD has actively enforced LGPD including on automated decision-making, making Brazil one of the few jurisdictions outside Europe with active enforcement of AI-adjacent data protection obligations.

Regulatory frameworks

LGPDIn force

Lei Geral de Proteção de Dados, Brazil's comprehensive data protection law, modelled largely on GDPR. In force since 2020, with enforcement by ANPD. Applies to AI systems processing personal data of people in Brazil.

Bill 2338/2023In Congress

Brazil's AI Bill, passed the Senate in December 2024 and is still before a Chamber of Deputies special committee, awaiting the rapporteur's report as of August 2026. Creates a risk-based AI framework, prohibits certain high-risk AI applications, and establishes transparency and accountability requirements. No adoption date has been set.

ANPDActive

Autoridade Nacional de Proteção de Dados, Brazil's national data protection authority. Enforces LGPD, has issued AI-specific guidance, and is expected to have a central role in AI law enforcement when Bill 2338 passes.

Americas hub Brazil LGPD deep dive

AI governance in Brazil.

Key facts for organisations

▸Brazil is the most active AI governance jurisdiction in Latin America, with LGPD in force, an AI Bill still before Congress, and a mature data protection authority.

▸The LGPD creates specific rights around automated decision-making: individuals can request review of decisions made solely by automated means that affect their interests, and organisations must give clear and adequate information about the criteria and procedures involved. Two limits matter. Article 20 does not require the review to be done by a human, because Congress upheld the veto of the natural-person requirement on 2 October 2019, and the information right is expressly subject to commercial and industrial secrecy.

▸Bill 2338, which the Brazilian Senate passed in December 2024, creates a risk-based AI framework with prohibited practices, conformity assessment for high-risk AI, transparency obligations, and liability rules. As of August 2026 it is still before a Chamber of Deputies special committee, awaiting the rapporteur's report.

▸Brazil is a member of the Global Partnership on AI (GPAI) and has engaged in international AI governance discussions, including the G20 AI principles under Brazil's 2024 G20 presidency.

▸Australian organisations with Brazilian customers, employees, or operations are subject to LGPD when processing personal data of individuals in Brazil, including through AI systems.

▸ANPD has actively enforced LGPD including on automated decision-making, making Brazil one of the few jurisdictions outside Europe with active enforcement of AI-adjacent data protection obligations.

Regulatory frameworks

LGPDIn force

Bill 2338/2023In Congress

ANPDActive