Makes public services decisions, in Brazil

Lei nº 13.709, de 2018 (LGPD), art. 20 (review of automated decisions) · Read the law's page

• Let a data subject request review of any decision made solely on automated processing of their personal data, including a decision that defines their personal, professional, consumer, or credit profile or an aspect of their personality.
• Provide, on request, clear and adequate information about the criteria and procedures used for an automated decision, subject to trade and industrial secrecy.

Lei nº 13.709, de 2018 (LGPD), arts. 5º, II, 11-14 (sensitive personal data and children's data) · Read the law's page

• Obtain specific, highlighted consent, or another article 11 legal basis, before processing sensitive personal data such as health, genetic, or biometric data.
• Process a child's or adolescent's personal data only with specific, highlighted consent from at least one parent or legal guardian, except to contact the parent once without storing the data or to protect the child, and never condition participation in a game, application, or other activity on more personal data than the activity strictly needs.
• Do not treat anonymized data as personal data unless the anonymization process can be reversed using your own means or with reasonable effort, and treat data used to build an identifiable behavioral profile as personal data again.
• Give a public-health research body access to personal data only within a controlled and secure environment, anonymized or pseudonymized where possible, and never transfer that data to a third party.
• Do not share sensitive health data between controllers for economic advantage, except for the data subject's requested portability or the listed health-service, pharmaceutical, or health-assistance transactions.

Lei nº 15.211, de 17 de setembro de 2025 (Estatuto Digital da Criança e do Adolescente), arts. 7º, 16, 22 and 26 · Read the law's page

• Configure any product or service directed at children and adolescents, or likely to be accessed by them, by default to the most protective privacy and data-protection setting available, and do not process their personal data in a way that causes, facilitates or contributes to a violation of their privacy.
• When you process the data of children and adolescents, above all for purposes not strictly necessary to run the product or service, map the risks, make efforts to mitigate them and prepare a data-protection impact, monitoring and evaluation report to share when the authority requests it.
• Do not use profiling techniques to direct commercial advertising at children and adolescents.
• Do not build behavioral profiles of child and adolescent users from their personal data, including data obtained in age verification, to direct commercial advertising.

Projeto de Lei nº 2.338/2023 (aprovado pelo Senado Federal em 10 de dezembro de 2024) · Read the law's page

• As approved by the Federal Senate in substitute form, the bill establishes a general, risk-tiered legal framework for the development and use of artificial intelligence in Brazil.