Published
7 MIN READ
LGPD and artificial intelligence: what your product needs
The LGPD, Brazil's data protection law, and artificial intelligence meet whenever a product with AI processes personal data: at sign-up, in the text sent to the model, in the conversation history or in an automated decision. The law doesn't prohibit AI. It requires a stated purpose, minimal data, security by design and review when the machine decides on its own.
There's a distinction many project conversations ignore. Using AI to build the software is one thing; putting AI inside the product, reading users' data, is another, and the law weighs on the second. At Wama, AI is used in code and automation, with Claude Code and Framer's agents, and every result goes through human review before it reaches the client. Anyone at the point of building a SaaS with AI and charging the first customer needs to solve the LGPD part before launch, because it changes screens, the database and the contract.
What does the LGPD require of a product with artificial intelligence?
The LGPD has no chapter on AI, and it doesn't need one. The principles in article 6 apply to any processing: a specific purpose disclosed to the data subject, necessity (the minimum data needed to fulfill the purpose) and transparency. An AI feature that summarizes support conversations needs a written purpose, and that purpose doesn't authorize using the same conversations to train another model later.
The point that most affects whoever builds is in article 46. According to the consolidated text of the LGPD on the Planalto website, security measures must be observed from the design phase of the product or service through its execution. In project terms: privacy is a requirement, not a last-minute fix. The split of roles between the company and whoever develops, explained in the article on who answers for the data, controller or processor, still applies when an AI model comes into the middle.
When does an automated decision need review?
Review comes in when the product makes a decision based solely on automated processing and that decision affects someone's interests. Article 20 of the LGPD expressly cites decisions that define personal, professional, consumer and credit profiles. In those cases, the data subject can request a review, and the company must disclose, when asked, the criteria and procedures used.
In the product, this shows up in concrete places: a score that approves or rejects a sign-up, automated candidate screening, a price that changes by profile, an account blocked on suspicion. The current text talks about review without saying who reviews. In Wama's reading, the review that holds up is one done by someone with the power to change the outcome, which requires a queue, an internal screen and a record of each decision (what went in, which model version, what came out). AI customer service has its own rules in some sectors, as shown in the article on what customer service AI can do in a fintech app.
Where does the data go when the product calls an AI model?
The data goes to the model provider, which usually processes the information on your company's behalf and plays the role of processor. The LGPD requires the processor to follow the controller's instructions (article 39), and controller and processor must keep records of processing operations (article 37). If the model's server is outside Brazil, there's an international data transfer.
For that case, CD/ANPD Resolution No. 19, of August 23, 2024, approved standard contractual clauses and gave 12 months from publication for those already using contractual clauses to incorporate the ANPD's text. That deadline ended in 2025. At Wama, the project is transferred to the client's account and the subscription goes on the client's card. The same logic applies to the AI API account: in the name of the company that owns the product, like the owner of the code in custom software.
What to decide in the project before the first screen
Compliance costs less when it comes in as a requirement, together with the scope. At Wama, a request with a logged-in area and user data stops being a website and becomes a digital product project, and it's in this kind of project that these answers need to exist before design:
Data map per AI feature: what goes into the prompt, what comes back, where it's stored and for how long.
Purpose and legal basis per feature: written down, one for each use, with no generic purpose.
Minimal data: the model receives only the field it needs, never the whole profile.
Notice in the interface: the user knows when they're talking to AI and what it does with what they write.
Review path: for automated decisions, a review request that reaches a person.
Retention of conversations and records: a defined period and automatic deletion.
Many of these items become visible components, and the interface of a SaaS is where transparency shows up for the user.
Why the ANPD will look at AI through 2027
Enforcement is no longer hypothetical. CD/ANPD Resolution No. 30, published in the Official Gazette on December 24, 2025, approved the Priority Topics Map for 2026 and 2027. Topic 4 is artificial intelligence and emerging technologies: 20 enforcement activities on the processing of personal data in that context, including that of children and teenagers, half by the first half of 2027 and half by the second.
The authority also changed stature. Under Law No. 15,352, of 2026, the ANPD became the Agência Nacional de Proteção de Dados (National Data Protection Agency), a special-status government agency with functional, technical, decision-making, administrative and financial autonomy. The topic has been in preparation for a while: the call for input on AI and review of automated decisions, open from November 6, 2024 to January 24, 2025, received 99 contributions. Anyone planning to connect AI to the company's systems lands right on that radar.
Common mistakes
A generic privacy notice: a text that doesn't mention the AI feature doesn't really disclose the purpose.
Sending the whole profile to the model: it's easier to code and violates the necessity principle.
Keeping conversations to train on later: a new purpose calls for a new legal basis and notice, not an eternal archive.
An automated decision with no way out: rejecting someone with no review path is exactly the case article 20 describes.
The API account in the developer's name: the contract with the model provider ends up outside the control of whoever answers for the data.
These mistakes show up early in SaaS development, when the rush to launch pushes the data architecture to later.
Frequently asked questions
Does the LGPD prohibit using artificial intelligence with customer data?
No. The LGPD doesn't prohibit any technology. It requires processing to have a legitimate, disclosed purpose, a legal basis, minimal data and security from the product's design. AI falls under the same rules as any system, with extra attention to automated decisions, which give the data subject the right to request review.
Does using AI to develop the software already require LGPD compliance?
It depends on where personal data flows. Wama designed the app for Cappta, a payment institution, with AI support in the building workflow, and that's different from a product that sends user data to a model. What matters is AI processing real people's data in production.
Does an AI chatbot need to say it isn't a person?
The LGPD doesn't have that sentence ready-made, but the transparency principle requires clear information about the processing and about who carries it out. In practice, saying the conversation is with AI, explaining what happens to the text sent and offering a path to a person solves most of the risk.
Can anonymized data go to the model without worry?
Only if the anonymization is real. The LGPD considers data anonymized when its subject can't be identified, considering reasonable and available technical means. Swapping the name for a code while keeping email, city and purchase history rarely meets that definition, and then the law still applies.
Do I need an impact assessment for a product with AI?
The ANPD can require, under article 38, a data protection impact report with the types of data, the collection and security methodology and the risk mitigation measures. For a product with automated decisions or sensitive data, it's worth having the document ready before anyone asks.
If your product is going to put AI near customer data, these answers cost less when they're designed along with the screens. Talk to Wama about the project before the first line of code.
