Brazil's LGPD gives people the right to request review of decisions made solely by automated processing that affect their interests, and to clear information about the criteria used. For organisations running AI agents, staff must be trained to carry out those reviews, explain criteria without exposing trade secrets, keep agents to a legal basis, and spot discrimination and incidents.
What does the LGPD ask of staff who work with agents?
The Lei Geral de Proteção de Dados governs personal data processing in Brazil. In substance, every processing activity needs a legal basis. The list includes consent, performance of a contract, compliance with a legal obligation, legitimate interest, and protection of credit, which matters for lenders and collections. Processing must follow principles including purpose, adequacy, necessity, data quality, transparency, security, prevention, non-discrimination and accountability.
People may request review of decisions taken solely on the basis of automated processing that affect their interests, including decisions that define their personal, professional, consumer or credit profile. They are entitled to clear and adequate information about the criteria and procedures used, subject to commercial and industrial secrets. Where that information is withheld on secrecy grounds, the ANPD, Brazil's data protection authority, may audit for discriminatory aspects.
Controllers must appoint a data protection officer, known as the encarregado, to handle requests and liaise with the ANPD. They must report security incidents that may cause relevant risk or harm to the ANPD and to affected people. International transfers are allowed only on the conditions the law sets.
Whether the LGPD reaches agents is covered in does the LGPD apply to AI agents. For training purposes: the controller's duties apply to everything its agents do.
Who does it apply to?
Any organisation processing personal data in Brazil, offering goods or services to people in Brazil, or processing data collected in Brazil. Sector regulators add expectations: Banco Central do Brasil for banks and payment institutions, including those running Pix instant payments; CVM for securities markets; and SUSEP for insurers.
Staff in scope include customer service teams supervising agents, credit and collections analysts, fraud teams working Pix and card alerts, marketing teams using agent-drafted offers, data and IT staff setting agent sources, and the encarregado. For a sector view, see what AI agent training organisations in Brazil need.
What competence does the LGPD imply when agents act?
Legal basis for each source. Staff who connect an agent to new data must know the legal basis. Credit protection may cover a scoring agent reading bureau data; it does not cover a marketing agent using the same data for offers.
Review on request. When a customer asks for review of an agent's decision, such as a credit refusal, a limit cut or a fraud block, the reviewer must re-decide, not confirm. That needs authority to change the outcome and access to the evidence. Decisions with significant effect are better held for a named person before they reach the customer.
Explaining criteria. Reviewers must be able to tell a customer which factors drove the decision, clearly enough to be useful, without exposing detection logic or model internals that are commercially secret. That is a skill to practise.
Non-discrimination. The LGPD forbids processing for unlawful or abusive discriminatory purposes. Supervisors must recognise proxies in an agent's reasons, such as postcode, device type or name, and escalate patterns of worse outcomes for particular groups.
Speed with Pix. Pix settles instantly. A fraud agent may block suspicious transfers at depth 3 under the firm's bounds, but releasing a held transfer moves money and is depth 4, held for a person. Fraud staff must review fast without rubber-stamping. AI agent training for fraud analysts in e-commerce in Brazil covers that role.
Incident recognition. An agent that exposes one customer's data to another, or sends data to the wrong party, may have caused a reportable incident. Staff must escalate at once.
How do you meet the LGPD and show it?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Legal basis for processing | Each agent source mapped to a legal basis | Processing register with bases |
| Review of automated decisions | Significant agent decisions held or reviewed on request by trained staff | Hold logs; review records with outcomes |
| Information on criteria | Reviewers trained to explain decision factors | Explanation records |
| Non-discrimination | Outcome monitoring by group; supervisors trained on proxies | Fairness reports; escalations |
| Security incident reporting | Staff trained to recognise agent-caused incidents | Incident log; ANPD reports |
| Encarregado | DPO involved in agent design and review process | DPO sign-offs |
| International transfers | Data location and transfer basis recorded per agent | Transfer register |
| Record | Every agent verdict filed with sources used | Append-only decision record |
What will the ANPD or an auditor ask?
- What legal basis supports each agent's processing?
- How do customers request review of an agent's decision, and who reviews it?
- Show us explanations given to customers. Are they clear?
- How do you check for discriminatory outcomes?
- How would staff recognise a data incident caused by an agent?
- What training have reviewers and supervisors received?
What does the LGPD not cover?
It does not set conduct or prudential rules for financial firms; Banco Central do Brasil, CVM and SUSEP do. It does not regulate AI as a technology. It does not prescribe training content or certificates. And it does not override legal duties such as anti-money laundering reporting. Other regimes differ in detail; compare PIPEDA training in Canada and Singapore PDPA training. The guide to AI literacy and certification sets out the wider model.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy trains reviewers on the real product, with module tests set in the learner's own industry and role. The Operator track covers human review and when something goes wrong; its written exam is 40 questions in 60 minutes, with 32 correct needed to pass. Certificates are issued through VerifyDoc.ai, so an organisation can show the ANPD or an auditor that each reviewer was certified when they decided.
Questions people ask
Does the review right require a person to review?
The LGPD gives a right to request review. In practice, a meaningful review needs a trained person with authority to change the outcome.
Can we refuse to explain an agent's criteria?
You can protect commercial secrets, but must still give clear and adequate information. The ANPD may audit where information is withheld.
Is credit protection a valid basis for an agent?
It can support processing to assess credit risk. It does not stretch to unrelated uses like marketing.