LGPD and artificial intelligence: how to use AI without exposing data
Brazil’s LGPD applies to generative AI whenever personal data is involved. See where data leaks in practice and the steps to use AI safely at your company.
The LGPD, Brazil’s General Data Protection Law, applies to artificial intelligence whenever AI processes personal data, whether in the text typed into an assistant, the documents uploaded or the answers generated. Using generative AI without exposing data comes down to three choices: what data goes in, where the AI runs and who can see what it does. Once those choices are made, AI becomes a work tool, not a source of leaks.
The challenge is that generative AI reached companies through their people, often before the rules did. This guide explains how the LGPD relates to AI, where the most common risks are and a practical plan to organize its use. It does not replace legal advice: confirm every decision with your legal team and your company’s data protection officer.
Does the LGPD apply to generative AI?
Yes. The LGPD (Law 13.709/2018) is in force and covers any processing of personal data, with or without AI. If an employee pastes a customer’s name, tax ID or history into an AI tool, that is processing of personal data and it must follow the law. The ANPD, Brazil’s national data protection authority, is in charge of enforcement.
In practice, the principles your company already applies still hold: have a legal basis to use the data, use it only for the stated purpose, process only what is necessary and keep it secure. AI does not create an exception. It simply makes it easier, and faster, to step outside those limits without noticing.
There is also a specific point about automated decisions. When a decision that affects a person is based solely on automated processing, the data subject may request a review of that decision (article 20 of the LGPD). If AI takes part in decisions on credit, hiring or customer service, you need to be able to explain what happened and offer a review path.
Where does company data leak when people use AI?
The most common risk is also the simplest: someone copies customer data, contracts or financial spreadsheets into a public AI tool, with no contract with the company and no control over what happens to that content. The goal is to save time. The result is losing control of the data.
Another issue is access that is too broad. When an AI assistant is connected to company systems with permission to see everything, it may surface information in an answer that the person asking should not see. The problem is not the AI itself, but the permission it was given.
Finally, there is what gets left behind: chat histories, technical logs and generated answers that contain personal data. If no one knows where these are stored or for how long, the company cannot respond to a data subject’s request or show that it handled the information properly.
None of these risks requires bad intent. Most of the time, people are simply trying to work better with the tools at hand. That is why banning everything rarely works: the use continues, just out of the company’s sight. The more effective path combines clear rules, a safe corporate alternative and practical guidance on what can and cannot go into an AI tool.
How to use generative AI without exposing data: 6 steps
1 · Map where AI is already used. Ask each area which tools they use and for what. The goal is not to punish but to see. Without this map, any policy stays on paper.
2 · Classify your data. Define what is public, internal, confidential and sensitive personal data. Make clear, with examples, what must never go into a tool without approval.
3 · Offer a corporate alternative. When the company provides an AI environment with a contract, data usage rules and operation inside its own perimeter, people stop turning to tools on their own.
4 · Give AI access only to what is needed. Each agent or assistant should see only the data it needs for the task, respecting the same permissions the person would have.
5 · Record what the AI does. Keep track of what data was accessed, which rule was applied and what the result was. This record helps you answer data subjects, auditors and regulators.
6 · Keep human review in decisions about people. Where AI influences decisions that affect customers or employees, define who reviews them and how the data subject can request that review.
What about PL 2.338/2023, Brazil’s AI bill?
Beyond the LGPD, Brazil is debating PL 2.338/2023, a bill that creates a legal framework for AI with a risk-based approach. The Senate approved it on December 10, 2024 and, as of October 2026, it was still under analysis in a special committee of the Chamber of Deputies, with the vote postponed until after the elections. If the Chamber amends the text, it returns to the Senate.
The text may change, but its direction is consistent with the LGPD: more transparency, human oversight and records for high-risk systems. The steps above help on both fronts. Even so, each case should be assessed with your company’s legal team.
How Semantix uses AI with client data
At Semantix, there is no AI without context, and the context belongs to the client. AI agents and specialists operate processes with access only to what is needed, and personal data, such as CPF, CNPJ and e-mail, is masked before it reaches the model. You choose where the models run, including in Brazil or in your own environment. Safetix, part of the Semantix AI Suite, applies rules and permissions, with every execution traced and human approvals recorded. What the operation learns stays yours.
We operate with ISO 27001, ISO 27701, PCI-DSS and SOC 2 Type II certifications and follow the LGPD and sector rules. If you want to know where AI already touches sensitive data at your company, a diagnostic shows the starting point.
You choose how far Semantix goes: use the Semantix AI Suite with your team, build together with Semantix or contract the operation. That is how Semantix, The Enterprise AI Company, builds enterprises that learn.
“The problem is not the AI itself, but the permission it was given.”
Insights
Frequently asked questions
Can I put customer data into a public AI tool?
Customer personal data should only go into tools your company has approved, with a contract and clear data usage rules. Pasting that data into a public tool without those safeguards means processing personal data outside the company’s control. Confirm the policy with legal and your data protection officer.
Does the LGPD prohibit the use of artificial intelligence?
No. The LGPD does not prohibit AI, but it requires personal data processing to have a legal basis, a defined purpose, minimal use and security. It also gives data subjects the right to request a review of decisions based solely on automated processing.
What is the review of automated decisions under the LGPD?
It is the data subject’s right to request a review of a decision based solely on automated processing that affects their interests (article 20 of the LGPD). For companies, this means being able to explain the decision and having a review process in place.
Who oversees the use of personal data by AI in Brazil?
The ANPD, Brazil’s National Data Protection Authority, is responsible for the LGPD. Companies in regulated sectors must also follow the rules of their regulators, such as Bacen, CVM, ANS or Anvisa.