Brazil: privacy laws and AI data licensing

Which LGPD legal basis can cover reusing records about people in Brazil?#

Usually consent or legitimate interest, and for sensitive data only specific, highlighted consent or a narrow statutory exception. Article 7 of the LGPD lists the legal bases for processing; the first is the data subject's consent, and the controller carries the burden of proving consent was obtained as the law requires.

Under Article 3 the law applies wherever the company is based when processing takes place in Brazil, targets individuals located in Brazil, or uses data collected in Brazil, meaning the person was there at the moment of collection.

Legitimate interest (Article 7, IX, and Article 10) allows only the personal data strictly necessary for the purpose, and the ANPD may ask the controller for a data protection impact report. The ANPD's legitimate interest guide sets out a balancing test in three phases (purpose, necessity, and balancing with safeguards) and says a new purpose needs a new test. In July 2024 the ANPD ordered Meta to suspend using posts on its platforms to train AI, finding in a preliminary analysis that legitimate interest was inadequate; it lifted the measure that August after a compliance plan, while stating that this was not unrestricted approval of legitimate interest for every AI training use.

When are Brazilian records anonymized enough to fall outside the LGPD?#

Only when the anonymization cannot be reversed with reasonable efforts. Article 5, XI defines anonymization as using reasonable technical means available at the time of processing so that data loses the possibility of direct or indirect association with an individual, and Article 12 says anonymized data is not personal data unless the process can be reversed using the controller's own means or with reasonable efforts.

Article 12, paragraph 1 says what counts as reasonable is judged on objective factors, such as the cost and time needed to reverse the process with the technology available. Paragraph 2 adds that data used to build the behavioral profile of an identified person can be treated as personal data, and paragraph 3 lets the ANPD set anonymization standards and techniques.

Pseudonymized data stays inside the law. Article 13, paragraph 4 describes pseudonymization as processing after which data can only be linked to a person using additional information the controller keeps separately in a controlled, secure environment. Swapping names for codes while keeping the key is pseudonymization. The ANPD has also published a technical study analyzing anonymization under the LGPD.

How can personal data about people in Brazil be transferred abroad?#

Through one of the routes in Article 33, which in practice for most private transfers means the ANPD's standard contractual clauses. Article 33 allows transfers to countries or international bodies with an adequate level of protection, or where the controller offers and proves safeguards such as specific contractual clauses, standard contractual clauses or global corporate rules, plus a few other listed cases.

Resolution CD/ANPD No. 19 of 23 August 2024 sets the international transfer regulation and the Brazilian standard clauses. A transfer based on them is valid only if the Annex II text is adopted in full and without alteration in an instrument signed by exporter and importer. The clauses can sit in a dedicated contract or be added to a broader contract by addendum, and other terms may not exclude, modify or contradict them. Controllers already relying on contractual clauses were given up to 12 months from publication to incorporate the approved text. The ANPD's transfer page states that no foreign standard clauses have yet been recognized as equivalent, so EU clauses alone do not satisfy the Brazilian rule.

The regulator is the ANPD, which Congress turned into a regulatory agency, now the Agência Nacional de Proteção de Dados with the same acronym. Under Article 52, a simple fine can reach 2% of the company group's revenue in Brazil in its last financial year, excluding taxes, capped at R$50 million per infraction.

What should be checked before records about people in Brazil are shared?#

A short pre-release check, confirmed by counsel against current law and ANPD rules, covers most LGPD questions.

SourceX can consider companies in Brazil when the data they offer is at least 90% English, confirmed on the actual dataset; every dataset still goes through rights, privacy, quality and buyer-fit review.

• 1Flag records about people who were in Brazil when the data was collected, and records from serving customers in Brazil, wherever the company is based
• 2Record the legal basis for the new use: proof of consent, or a written legitimate interest balancing test for this specific purpose
• 3Separate sensitive data (health, biometric, genetic, racial or ethnic origin and similar) and exclude it unless specific, highlighted consent covers the use
• 4Decide whether the released set is truly anonymized or only pseudonymized, and keep the re-identification assessment, including cost and time to reverse
• 5If personal data leaves Brazil, sign the ANPD standard contractual clauses unchanged, or document another Article 33 route