Brazil: General Personal Data Protection Law (Law No. 13,709/2018)

BrazilLegislationApplicable

Law No. 13,709/2018 (Lei Geral de Proteção de Dados Pessoais - LGPD) creates the overarching legal framework for personal data processing across public and private sectors in Brazil. Warden Watch focuses specifically on the provisions regulating automated decision-making and profiling within employment and recruitment, centered on Article 20 and Article 6(IX). The law grants data subjects the right to request a review of decisions made solely on the basis of automated processing of personal data that affect their interests, expressly encompassing decisions defining professional, personal, consumer, or credit profiles. Controllers must supply clear, adequate information regarding the criteria and procedures used for automated decisions upon request, subject to commercial and industrial secrets. If a controller withholds information citing trade secrets, the National Data Protection Authority (ANPD) is empowered to carry out audits to detect discriminatory aspects in the automated processing. The law does not mandate routine pre-deployment bias audits or establish direct liability for software vendors.

Impact

What this means for HR and vendors

HR and recruitment teams

HR teams and recruitment specialists in Brazil using AI or automated filtering tools must prepare for candidate and employee review requests. Organizations using solely automated systems to screen CVs, rank job applicants, allocate shifts, or evaluate employee performance must establish internal procedures to review contested outcomes and provide clear explanations of decision criteria. While the law does not explicitly require human-only reviews following the 2019 presidential veto, HR departments should maintain human oversight capabilities to assess contested cases and mitigate discrimination risks. This increases the importance of documenting criteria and monitoring algorithmic decisions.

HR technology vendors

Providers of AI recruitment platforms, automated assessment software, and talent management tools deployed in Brazil face commercial expectations to support deployer compliance. While the LGPD places direct legal duties on data controllers rather than software vendors, providers must equip employer clients with transparent documentation detailing system criteria, decision logic, and operational parameters. Platforms should be designed to allow employer administrators to review automated scores, adjust profiles, and explain criteria to workers without disclosing proprietary source code. Providers should also anticipate supporting deployers if the ANPD audits algorithms for discriminatory bias under Article 20(§ 2).

Key obligations

What organizations need to do

Practical obligation briefings focused on what the requirement is, who it applies to, when it applies and what teams should consider doing.

DeployerAppeal & Opt-Out Rights

Provider Explanatory Collateral and Audit Support

OBLIGATION

APPLIES TO

STATUS

Keep up with changes to employment AI rules and cases.

Get an email when we add important regulation or litigation, or when a tracked matter materially changes.

Not legal advice

This page is regulatory intelligence only. Organizations should seek guidance from legal counsel before making compliance decisions.

Employment-focused extraction

This may be part of wider regulation. The Warden Watch extracts and displays the parts relevant to employment, HR and recruitment decision-making.

HR and recruitment teams

HR technology vendors

Right to Review Solely Automated Decisions and Profiling

Disclosure of Automated Decision Criteria and Procedures

Regulatory Audits for Algorithmic Discrimination

Prohibition of Algorithmic Discrimination in Employment

Provider Explanatory Collateral and Audit Support

Keep up with changes to employment AI rules and cases.

Manage Consent Preferences