Brazil Lei Geral de Proteção de Dados Pessoais (Lei 13.709/2018)

Required actions

• Article 20: data subjects may request review of decisions taken solely on automated processing that affect their interests, and controllers must explain the criteria used - Identify a legal basis for training models on personal data; ANPD has treated legitimate interest for generative-AI training as requiring safeguards and opt-outs - Carry out data protection impact reports on request of ANPD

Sources

• planalto.gov.brhttps://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm