#
ADM transparency right is in force but implementation guidance is nascent; the horizontal AI statute remains unconfirmed as fully enacted; state-surveillance carve-outs are statutorily defined but ANPD's practical oversight role there is limited.
Sub-modules (6)
Profiling RestrictionsAmber
The SGD's DPIA guideline recommends impact assessments where processing involves location tracking, behavioral profiling, or automated decision-making with legal effects on a person's personal, professional, consumer or credit profile.
Claims (1):
- The SGD DPIA guideline suggests a DPIA where processing involves tracking data subjects' location, formation of a behavioral profile, or automated decision-making with legal effects on personal, professional, consumer or credit profiles, or involving children and teenagers.
Automated Decision Making TransparencyAmber
Article 20 of the LGPD guarantees individuals the right to request review of decisions made solely through automated processing of personal data; ANPD's Technical Note 12/2025 (May 2025) summarised public input on AI/ADM to inform future regulation.
Claims (1):
- Article 20 of the LGPD guarantees individuals the right to request a review of decisions made solely through automated processing of personal data.
Ai Risk AssessmentsAmber
The Brazilian AI Bill (PL 2338/2023), a risk-based framework drawing on the EU AI Act, passed the Senate in December 2024 and was under Chamber of Deputies discussion; separate sector-specific AI bills (e.g., AI-based domestic-violence-offender monitoring, Bill 750/2026) are also in progress. Final enactment status of PL 2338/2023 could not be confirmed as of this research pass.
Claims (2):
- The Brazilian Artificial Intelligence Bill (PL 2338/2023) had its wording approved by the Senate in December 2024 and draws parallels with the EU AI Act's risk-based approach.
- Bill No. 750/2026, before the Chamber of Deputies, would establish a National Program for Monitoring Aggressors Using Artificial Intelligence, combining electronic monitoring, behavioral analytics and real-time alerts.
Biometric RegimeAmber
Biometric data is classified as sensitive personal data under Art. 5 II and subject to Art. 11 processing restrictions; age-verification mechanisms under the Digital ECA increasingly rely on soft-biometric signals (e.g., typing patterns, device position), raising fresh biometric-processing questions.
Claims (1):
- Age-verification approaches evolving under Brazil's Digital ECA framework increasingly draw on soft biometrics such as typing patterns and device position to assess probable user age.
Genetic DataGreen
Genetic data is expressly listed among sensitive personal data categories under Art. 5 II, subject to the same Art. 11 restrictions as other special categories.
Claims (1):
- Genetic and biometric data are expressly included within the LGPD's definition of sensitive personal data under Article 5 II.
State Surveillance CarveoutsAmber
The LGPD does not apply to processing for public security, national defense, state security, or investigation/prosecution of criminal offenses, but ANPD retains authority to issue technical opinions, recommendations, and to request a DPIA from controllers even in these carve-out scenarios.
Claims (1):
- For public security, national defense, state security, or investigation/prosecution of criminal offenses, the LGPD is not applicable, but ANPD retains the attribution of issuing technical opinions, recommendations and requesting a DPIA from controllers (Art. 4 §3).
Algorithmic, Biometric & Surveillance Governance
Two distinct developments define this module's material content this cycle. First, ANPD published a Report on Generative AI, understood to analyse the implications, risks and challenges associated with generative-AI technologies, representing the regulator's move into active engagement with AI-specific governance questions ahead of any dedicated AI-processing rule.
Second, and providing important enforcement-precedent context, in 2025 ANPD issued a preliminary order prohibiting Tools for Humanity, the operator of Worldcoin, from collecting iris scans in exchange for cryptocurrency in Brazil, backed by a daily fine of R$50,000 for non-compliance. This action is understood to demonstrate ANPD's willingness to halt biometric-data operations at a preliminary, pre-merits stage where mass-impact risk is present, notably occurring ahead of any dedicated biometric-data regulation, which remains a later-phase item on ANPD's 2025-2026 Regulatory Agenda, following data subject rights, DPIAs, government data-sharing and minors' data in the agenda's sequencing.
Read together, the generative-AI report and the Worldcoin biometric enforcement precedent indicate that ANPD is building governance capacity and enforcement precedent in the algorithmic and biometric space ahead of, rather than through, dedicated statutory rules specific to those categories.
Outlook
Dedicated biometric-data regulation remains a later-phase Regulatory Agenda item with an expected multi-year horizon; watch for whether the Worldcoin enforcement precedent is followed by further preliminary orders against other biometric-data operations pending that dedicated rule.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and claims (7)
- ProbableIAPP — The SGD DPIA guideline suggests a DPIA where processing involves tracking data subjects' location, formation of a behavioral profile, or automated decision-making with legal effects on personal, professional, consumer or credit profiles, or involving children and teenagers.observed
- ConfirmedIAPP — Article 20 of the LGPD guarantees individuals the right to request a review of decisions made solely through automated processing of personal data.observed
- UncertainOneTrust DataGuidance — The Brazilian Artificial Intelligence Bill (PL 2338/2023) had its wording approved by the Senate in December 2024 and draws parallels with the EU AI Act's risk-based approach.observed
- ConfirmedIAPP — Bill No. 750/2026, before the Chamber of Deputies, would establish a National Program for Monitoring Aggressors Using Artificial Intelligence, combining electronic monitoring, behavioral analytics and real-time alerts.observed
- ProbableIAPP — Age-verification approaches evolving under Brazil's Digital ECA framework increasingly draw on soft biometrics such as typing patterns and device position to assess probable user age.observed
- ConfirmedIAPP — Genetic and biometric data are expressly included within the LGPD's definition of sensitive personal data under Article 5 II.observed
- ConfirmedIAPP — For public security, national defense, state security, or investigation/prosecution of criminal offenses, the LGPD is not applicable, but ANPD retains the attribution of issuing technical opinions, recommendations and requesting a DPIA from controllers (Art. 4 §3).observed