In short
A credit team is testing an agent that reads customer records, payment history and service conversations to suggest each customer's limit. A customer asks for a review of a limit that went down. The request is backed by the LGPD, Brazil's data protection law, and the answer depends on knowing which personal data went into the model's context and where it came from. That knowledge is the role of the Company Brain, the layer that knows the company: what data exists, where it lives, how it relates and who can see what.
The General Personal Data Protection Law, Law 13,709/2018, regulates the processing of data about identified or identifiable natural persons. Processing includes collecting, storing, querying, classifying, sharing and deleting.
In a generative AI project, personal data can appear at four points: in the question, when someone types a customer's name; in the context, when the agent retrieves a record; in memory, when the conversation is kept; and in the answer, when it mentions a person. One of them is enough for the law to apply, and the analysis of each case is a job for legal and for the data protection officer, the DPO.
Article 6 of the LGPD lists the principles of processing. Seven of them weigh most in AI projects:
The LGPD allows processing only on one of the bases it provides for, such as consent, performance of a contract, legal obligation and legitimate interest. Sensitive data, such as health, biometrics and religious belief, has more restricted bases.
The practical question is which basis supports each use. Summarising a customer's history for the service they asked for tends to have a different justification from using the same history to train a model.
The data subject rights set out in the LGPD depend on the system knowing where each person's data is:
In the credit team, meeting the request means reconstructing which data went into the suggestion.
The controller makes the decisions about processing, and the processor handles data on its behalf. A model vendor called through an API is usually analysed as a processor. If it uses the content for its own purpose, such as training, the analysis changes, and the contract needs to address retention and deletion.
When the model runs on a server outside Brazil, the personal data sent in the call is transferred to another country. The LGPD allows that transfer in specific cases, such as a country with recognised adequate protection or contractual clauses approved by the ANPD, the national data protection authority.
The data protection impact assessment, the RIPD, describes high-risk processing and the measures to reduce that risk. The ANPD recommends preparing the RIPD before the controller starts processing and may require it when the basis is legitimate interest. AI uses that make decisions about people are natural candidates.
In an agent's memory, the mention of a diagnosis becomes stored sensitive data. Retention needs a time limit, and the end of processing leads to deletion, except where the law provides otherwise.
The ANPD regulates and enforces compliance with the LGPD, with the power to apply sanctions.
The Company Brain connects CRM, ERP, helpdesk and documents once, in a knowledge graph, a business ontology and a semantic layer. The databases stay in the customer's environment, and the model receives the context over MCP.
With a model running as an external service, the slice that is sent leaves the perimeter in that call and follows the vendor's terms. With a model on the company's own infrastructure, it stays inside too.
The Company Brain applies rules the company has defined. Legal basis, purpose, privacy notice and RIPD are legal decisions. A permission misconfigured at the source reaches the answer unchanged, and handling data subject requests, contracts and incident response remain processes.
The first step is to list the AI flows in use or in testing and mark where personal data comes in, with emphasis on sensitive data, decisions about people and transfers to vendors outside the country.
The flows that combine these factors go to legal and the DPO first, with legal basis, RIPD and retention defined before production. The map feeds the record of processing operations that the LGPD already requires.
