Personal Data and Artificial Intelligence: Regulatory Frontiers

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

The expansion of artificial intelligence over massive volumes of personal data creates urgent regulatory challenges that demand closer attention from businesses, governments, and citizens alike.

The Current Landscape: Personal Data as the Raw Material of Artificial Intelligence

We are living in a moment when artificial intelligence systems process extraordinary amounts of personal information every second. From recommendation algorithms on digital platforms to predictive analytics tools used by financial institutions and public agencies, personal data has become the main fuel of the computational models that shape everyday decisions. In this context, it is worth examining how regulatory boundaries must keep pace with the speed of these technological changes, so that fundamental rights are not sacrificed in the name of innovation.

Brazil’s General Data Protection Law (LGPD, Law No. 13.709/2018) established a robust regulatory framework for the processing of personal data, including principles such as purpose, adequacy, necessity, and transparency. Yet when we measure these requirements against the way artificial intelligence systems actually work, we see that applying these principles in practice runs into considerable obstacles. Machine learning models, for example, often operate as “black boxes,” making it difficult to explain automated decisions to data subjects, as required by Article 20 of the LGPD.

Internationally, we are seeing significant regulatory movement. The European Union has adopted its Artificial Intelligence Act (AI Act), which classifies AI systems by risk level and imposes obligations proportionate to each category. This risk-based approach speaks directly to personal data protection, because systems classified as “high risk” (those used in recruiting, credit, health care, and public safety) are subject to strict requirements for transparency, human oversight, and impact assessment. This European regulatory trend has been shaping legislative debates in many countries, Brazil included.

Data Due Diligence: A Strategic Necessity

Data due diligence is a systematic process of reviewing, assessing, and mapping how an organization collects, stores, processes, and shares personal data. When applied to artificial intelligence, this analysis becomes more complex, because it must look not only at the data itself but also at the algorithms that process it, the purposes for which they were trained, and the discriminatory impacts they may produce.

In the Brazilian corporate environment, data due diligence has become indispensable in mergers and acquisitions, fundraising, and strategic partnerships. Investors and business partners increasingly demand concrete proof of LGPD compliance before closing deals. Organizations that use artificial intelligence without a structured due diligence process expose themselves to significant legal, financial, and reputational risks. These include administrative sanctions from Brazil’s National Data Protection Authority (ANPD), which can reach up to 2% of the company’s revenue in Brazil (capped at R$ 50 million per violation).

An effective data due diligence process for artificial intelligence should include, at a minimum, the following elements: a complete inventory of the datasets used to train and operate the models; verification of the legal bases that support each processing operation; review of consent mechanisms (where applicable); assessment of the risks of algorithmic bias and discrimination; documentation of automated decision-making processes; and mapping of cross-border data flows, which is especially important when AI models are hosted or trained on servers located abroad.

Data due diligence applied to artificial intelligence is not merely a legal formality. It is a strategic governance tool that protects organizations against growing regulatory risks and strengthens the trust of consumers and business partners.

In addition, due diligence should include a technical assessment of how well AI systems are secured against adversarial attacks, leaks of training data, and inference techniques that make it possible to re-identify data subjects from supposedly anonymized data. Recent research shows that large language models can, under certain circumstances, reproduce excerpts of personal data found in their training sets, which raises complex legal questions about liability and regulatory compliance.

Regulatory Frontiers: Brazil’s Legal Framework in the Making

Brazil does not yet have specific, comprehensive legislation on artificial intelligence, although several bills are moving through the National Congress. Bill No. 2.338/2023, which proposes a regulatory framework for AI in the country, has been the subject of intense debate among civil society, academia, the private sector, and the government. The discussions over how to balance the promotion of technological innovation with the protection of fundamental rights, including privacy and personal data protection, are being closely followed.

Until that legal framework takes shape, the LGPD remains the main legal instrument applicable to the processing of personal data by artificial intelligence systems. Article 20 of the LGPD, which guarantees data subjects the right to request review of decisions made solely on the basis of automated processing, is one of the most relevant provisions in this context. If the ANPD issues regulations implementing this provision, they could set clearer parameters for algorithmic transparency and the explainability of automated decisions.

Over the past few years, the ANPD has published guidance documents that touch on the relationship between data protection and artificial intelligence. Of note is the Guidance on the Processing of Personal Data for Academic Purposes and for Conducting Studies and Research, which addresses relevant questions about the use of data in research projects involving AI. The Authority has also sought to open dialogue with regulators in other countries and with international organizations in order to harmonize regulatory approaches.

At the sector level, specific regulators already impose requirements related to the use of artificial intelligence and personal data. Through its rules on cybersecurity policy and on requirements for contracting data processing and storage services, Brazil’s Central Bank sets obligations that affect financial institutions using AI for credit analysis, fraud prevention, and customer service. The National Supplementary Health Agency (ANS) and the Federal Council of Medicine (CFM) have also taken positions on the use of AI systems in health care, recognizing both the benefits and the risks associated with processing patients’ sensitive data.

Concrete Risks and Mitigation Measures

The intersection of personal data and artificial intelligence creates risks that go beyond traditional privacy violations. Algorithmic bias, for example, can perpetuate and amplify historical discrimination based on gender, race, age, and socioeconomic status. When an AI system used to screen résumés is trained on data that reflects discriminatory patterns from the past, its automated decisions tend to reproduce those distortions at scale, affecting the fundamental rights of vulnerable groups.

Another relevant risk is the so-called “chilling effect” on civil liberties. The perception of constant surveillance by AI systems, such as facial recognition in public spaces or monitoring of communications, can discourage people from legitimately exercising rights such as freedom of expression, assembly, and association. This phenomenon calls for deep regulatory reflection on the limits on the use of artificial intelligence by public security agencies and by the private sector.

To mitigate these risks, organizations are advised to adopt data and AI governance practices that include: periodic Personal Data Protection Impact Assessments (RIPD), as provided for in the LGPD; algorithmic impact assessments that identify and measure potential discriminatory effects; human oversight mechanisms for high-impact automated decisions; ongoing training of technical and legal teams on the regulatory implications of using AI; and effective channels through which data subjects can exercise their rights, including the right to obtain clear information about the logic behind automated processes.

Future Outlook and Practical Recommendations

The regulatory landscape for personal data and artificial intelligence will keep evolving rapidly in the coming years. The global trend points toward convergence between data protection regulations and AI-specific regulations, creating an integrated legal framework that will require organizations to take a holistic approach to compliance. Companies that invest early in data and AI governance programs position themselves more competitively, reducing risk and creating value from the trust they build with the market.

In Brazil, the adoption of a regulatory framework for artificial intelligence will be a watershed moment. Whatever regulatory model is chosen (risk-based, rights-based, or hybrid), it is foreseeable that interoperability with the LGPD will be one of the central pillars of the new legislation. Organizations that already have mature LGPD compliance programs will have a solid foundation for adapting to the new requirements.

Managers and legal professionals are advised to closely follow legislative and regulatory developments in this area, invest in multidisciplinary technical training, and take a proactive approach to compliance. Data due diligence applied to artificial intelligence should not be seen as a cost or a bureaucratic obstacle, but as a strategic investment in organizational sustainability and resilience. The time to prepare for the regulatory frontiers ahead is now, not after sanctions are already being imposed.

This topic is directly related to artificial intelligence and regulation, which we cover in a dedicated article.

To round out your reading, see also the firm’s article on how intelligence.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.