Yes. Brazil's General Data Protection Law (LGPD) applies to any processing of personal data in Brazil or of people in Brazil, and an AI agent's reading, remembering and acting on customer data is processing. The points that matter most for agents are the legal basis, the principles of necessity and non-discrimination, and the right to review automated decisions.
What does the LGPD require, in substance?
The LGPD is enforced by the national data protection authority, the ANPD. It is technology-neutral and applies to agents through the organisation that runs them. In substance:
- A legal basis for each processing activity. The LGPD offers several, including consent, performance of a contract, compliance with a legal obligation, legitimate interest and a specific basis for credit protection.
- Principles, among them purpose, necessity (process only what the purpose needs), data quality, transparency, security, prevention and non-discrimination (no processing for unlawful or abusive discriminatory purposes).
- Sensitive personal data, such as health or biometric data, under tighter conditions.
- Rights for data subjects, including access, correction and, importantly for agents, the right to request review of decisions made solely on automated processing that affect their interests, including profiling. People are also entitled to clear information about the criteria and procedures used.
- Accountability: controllers keep records of processing, appoint a person in charge of data protection, and may be asked by the ANPD for a data protection impact report.
- International transfers only under the conditions the law sets.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What changes when the processing is done by an agent?
Decisions arrive by action. An agent that declines a payment, blocks a Pix transfer as suspicious or refuses a credit limit increase has made a decision affecting the customer's interests. If no person was involved, the review right applies, and the customer can ask how the decision was reached.
Necessity is tested continuously. An agent with broad read access tends to pull in more data than the task needs. Under the necessity principle, each source an agent can reach should be justified by its job.
Non-discrimination needs evidence. An agent may treat customers differently because of patterns in the data it reads, without anyone designing it to. You need to test outcomes across groups on your own cases. Structured approaches such as the NIST AI RMF applied to AI agents help organise this, though they do not replace the LGPD's duties.
What may the agent do, and what stays with a person?
- Agent may: process data for the documented purpose, answer customers' questions about their own data, and prepare responses to rights requests.
- Agent may, within limits: take routine decisions favourable to the customer, such as approving a standard request, where a legal basis exists.
- Stays with a person: reviewing any automated decision the customer contests, decisions adverse to the customer where your policy requires review, use of sensitive personal data outside a documented basis, and international transfers outside approved arrangements.
An illustrative example
Take a Brazilian digital bank whose agent monitors Pix transfers and blocks those it considers suspicious. A customer's transfer to pay rent is blocked twice in a month. She asks why, and asks for a person to review it.
The bank can answer only because the agent files each decision with the factors it relied on: a new recipient, an unusual amount, a login from a new device. A fraud analyst reviews the blocks, finds the device factor was misread, releases the payment and records the outcome. The bank adds this pattern to the agent's test cases and checks whether blocks fall unevenly on any group of customers.
Which controls meet the LGPD for agents?
| LGPD duty | Agent control | Evidence |
|---|---|---|
| Legal basis per purpose | Each agent capability mapped to a basis | Processing records |
| Necessity | Sources limited to what the job needs | Source permissions and reviews |
| Review of automated decisions | Decision record with factors; route to a person on request | Review log and outcomes |
| Non-discrimination | Outcome testing across customer groups | Test results |
| Security | Least-privilege access; provenance on inputs | Access logs |
| Impact report | Assessment per agent processing high-risk data | Report on file |
For a comparison with South Africa's approach, see whether POPIA applies to AI agents. The cross-regulation map is in AI agent regulation, mapped to controls.
Where Pryme fits
Every verdict an agent reaches in Pryme is filed with the facts it relied on and where each came from. That record is what a review under the LGPD needs: the factors behind the decision, and whether each one was sealed by a system of record or merely declared.
Questions people ask
Is consent the right basis for an agent's processing?
Often not. Consent must be free and can be withdrawn, which suits optional features. Core service work usually rests better on contract, legal obligation or legitimate interest, documented for each purpose.
Does the review right require a person to review?
The law gives the right to request review of decisions made solely by automated processing. Having a person carry out that review is the safe design, because a second automated pass rarely satisfies the purpose of the right.
Does the LGPD apply to a foreign company's agent?
It can. The LGPD applies where processing occurs in Brazil, where the purpose is to offer goods or services to people in Brazil, or where the data was collected in Brazil.