LGPD
Brazil's General Data Protection Law, which governs the processing of personal data. It imposes strict rules on sensitive data such as medical records, requiring anonymization to be irreversible before data can be excluded from its scope of application.
Timeline (last 90 days)
In regulated industries, AI governance frameworks need to be mapped to specific regulatory requirements, such as the Brazilian central bank's rules on outsourcing and data processing by financial institutions, and the LGPD (Brazilian General Data Protection Law) restrictions on the processing of personal data.
In Brazil, diagnoses must be made by a physician holding a CFM registration (Law No. 12.842/2013), telemedicine is governed by CFM Resolution No. 2.314/2022, software with medical use falls under ANVISA's RDC 657/2022, and medical records are sensitive personal data (Article 11 of the LGPD).
Under Article 42 of the LGPD, the controller bears objective liability for the effectiveness of the anonymization process, and outsourcing anonymization to a third-party vendor cannot transfer that liability.
Using only unsalted hashing (such as applying SHA-256 directly to a CPF) does not constitute sufficiently irreversible anonymization under the LGPD, and the information is still regarded as personal data.
If anonymized medical records are accidentally linked to a data subject, their anonymized status will be revoked, and all LGPD obligations are immediately activated, including incident notification (Article 48) and potential administrative sanctions.
If anonymization is effective and irreversible, then using anonymized medical records to train AI does not require patient consent, but processing activities prior to anonymization still require a legal basis.
The LGPD does not require formal certification of anonymization, but it requires objective technical evidence (including processing records, audit reports and negative re-identification tests) to demonstrate compliance to the ANPD.
Article 11 of the LGPD provides that anonymized data is excluded from the scope of the LGPD as long as the anonymization process meets the 'irreversible' requirement.
Article 5, item XII and Article 11, item I of the LGPD define anonymization as an irreversible process.
Article 46 of the LGPD explicitly excludes anonymized data from the obligation to notify security incidents.
4 more timeline events
All Facts (14)
In regulated industries, AI governance frameworks need to be mapped to specific regulatory requirements, such as the Brazilian central bank's rules on outsourcing and data processing by financial institutions, and the LGPD (Brazilian General Data Protection Law) restrictions on the processing of personal data.
50%UnverifiedIn Brazil, diagnoses must be made by a physician holding a CFM registration (Law No. 12.842/2013), telemedicine is governed by CFM Resolution No. 2.314/2022, software with medical use falls under ANVISA's RDC 657/2022, and medical records are sensitive personal data (Article 11 of the LGPD).
50%UnverifiedUnder Article 42 of the LGPD, the controller bears objective liability for the effectiveness of the anonymization process, and outsourcing anonymization to a third-party vendor cannot transfer that liability.
50%UnverifiedUsing only unsalted hashing (such as applying SHA-256 directly to a CPF) does not constitute sufficiently irreversible anonymization under the LGPD, and the information is still regarded as personal data.
50%UnverifiedIf anonymized medical records are accidentally linked to a data subject, their anonymized status will be revoked, and all LGPD obligations are immediately activated, including incident notification (Article 48) and potential administrative sanctions.
50%UnverifiedIf anonymization is effective and irreversible, then using anonymized medical records to train AI does not require patient consent, but processing activities prior to anonymization still require a legal basis.
50%UnverifiedThe LGPD does not require formal certification of anonymization, but it requires objective technical evidence (including processing records, audit reports and negative re-identification tests) to demonstrate compliance to the ANPD.
50%UnverifiedArticle 11 of the LGPD provides that anonymized data is excluded from the scope of the LGPD as long as the anonymization process meets the 'irreversible' requirement.
50%UnverifiedArticle 5, item XII and Article 11, item I of the LGPD define anonymization as an irreversible process.
50%UnverifiedArticle 46 of the LGPD explicitly excludes anonymized data from the obligation to notify security incidents.
50%UnverifiedCLM's deep security layer has built-in end-to-end security governance mechanisms that satisfy regulatory requirements such as LGPD.
50%UnverifiedBrazil's LGPD and Japan's amended APPI clearly drew on the GDPR framework during their legislative processes.
50%UnverifiedDecentralized networking solutions can meet enterprises' compliance and data sovereignty requirements, such as the requirements of GDPR, China's Data Security Law, and Brazil's LGPD regarding cross-border transmission of network metadata.
50%UnverifiedThe Brazilian tertiary hospital case completed implementation validation of the first three of CLM's six maturity stages under the LGPD framework.
50%