Is sending data to an LLM a transfer requiring separate legal analysis?

It is a disclosure to an operator, and where that operator processes outside Brazil it is also an international transfer governed by Chapter V. Both analyses depend on the same underlying facts: which categories of personal data were sent, to which destination, under which instruction. A deployment that routes across multiple providers without recording the destination per request cannot complete either analysis reliably.

Does a provider's no-retention commitment remove the LGPD obligation?

No. The commitment addresses secondary use by the operator, which is a real risk and a useful term to hold. The controller's obligations around purpose, legal basis, necessity, transparency, and the record of the recipient attach to the disclosure itself and survive any retention position the operator takes. Both facts belong in the file, kept separate.

How does Article 20 apply if a human reviews the model's output?

Article 20 attaches to decisions made solely on the basis of automated processing. Genuine human review with authority to change the outcome moves the decision outside that description. Review that rubber-stamps a model output without the information or authority to depart from it is unlikely to survive scrutiny, and the evidence that distinguishes the two cases is a record showing what the reviewer saw and what they changed.

Where does DeepInspect fit against LGPD obligations for LLM traffic?

DeepInspect evaluates HTTP traffic between authenticated users or agents and LLM endpoints routed through it, applying content classification and identity-bound policy before forwarding, and recording each decision independently. That supports the purpose, recipient, security measure and accountability evidence the LGPD asks for. Data collection upstream, internal system security, consent capture, and the model's own outputs are separate responsibilities.

Brazil LGPD LLM Requirements: The Obligations That Attach to Prompt Traffic

A prompt containing a customer's name, account number and complaint is a processing operation under the LGPD. It has a purpose, it needs a legal basis, it has a recipient, and someone is accountable for it. Brazilian organisations have generally accepted that framing for their databases and have not yet applied it to the HTTPS POST leaving an application for a model endpoint.

The requirements do not change because the destination is a model. What changes is how little of the usual evidence exists.

TL;DR

Sending personal data to an LLM is processing under the LGPD, requiring a purpose, a legal basis, and a record of the recipient.
Article 20 gives data subjects the right to request review of decisions based solely on automated processing, plus clear information on the criteria and procedures used.
The model provider is generally an operator processing on the controller's instructions, which makes the instruction itself an artefact worth recording.
Article 46 requires security measures protecting personal data from unauthorised access and accidental or unlawful situations, which covers the AI egress path.
Evidence of purpose limitation on prompt traffic requires classification before the request is sent, not after.

The processing framing, applied to a prompt

The Article 6 principles in Lei nº 13.709/2018 govern any processing operation: purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, and accountability. Applied to an outbound model call, each one asks a question the deployment usually cannot answer.

Purpose asks what the disclosure was for. Necessity asks whether the full content was required, or whether a redacted version would have served. Transparency asks whether the data subject was told this category of disclosure happens. Accountability, rendered in the Portuguese as responsabilização e prestação de contas, asks the controller to demonstrate effective measures rather than assert them.

That last principle is the one that decides whether a review goes well. Demonstration means artefacts with dates, and prompt traffic generates almost none by default.

Article 20 and models inside a decision

The IAPP English translation of the LGPD renders Article 20 as a right for the data subject to request review of decisions made solely on the basis of automated processing of personal data affecting their interests, including decisions intended to define their personal, professional, consumer and credit profile, or aspects of their personality. Whenever requested, the controller must provide clear and adequate information regarding the criteria and procedures used, subject to commercial and industrial secrecy.

Where an LLM contributes to such a decision, satisfying a review request means reconstructing the specific interaction: the input, the model and configuration, the output, the moment, and the identity that ran it. Describing the system in general terms addresses the wrong question, because the right is exercised against a decision affecting one person.

Two design choices make this answerable. Keep a per-decision record tying the output to its input and authorising identity. Keep the model version and configuration in that record rather than in a separate deployment manifest that has since moved on.

The operator relationship and the recipient record

A model provider processing prompts on the controller's instruction is acting as an operator under the LGPD. That relationship carries the usual consequences: an instruction, a defined purpose, security obligations, and a record of the recipient.

Provider retention terms matter here and settle less than teams assume. A commitment not to retain inputs or outputs reduces the risk of secondary use downstream. The disclosure to the operator still occurred, and a controller's records of processing are supposed to reflect it.

International transfer analysis follows from the same fact. Where the operator processes outside Brazil, Chapter V applies under rules the Brazilian data protection authority, the ANPD, administers, and the assessment depends on knowing which destination received which categories of data. A deployment that routes dynamically across providers without recording the destination cannot complete that analysis. Our LGPD AI controls mapping piece places these obligations against the control set.

Article 46 security measures on the egress path

Article 46 requires controllers and operators to adopt security, technical and administrative measures capable of protecting personal data from unauthorised accesses and from accidental or unlawful situations of destruction, loss, alteration, communication or any form of inappropriate or unlawful processing.

Communication is the word to underline. An employee pasting a customer record into a general-purpose model is a communication of personal data, and whether it was appropriate is exactly the Article 46 question. Transport encryption does not answer it, because the disclosure was authorised by the application and delivered securely to an unapproved recipient.

The control that does answer it evaluates the content and the destination before the request leaves. Network-layer tooling sits underneath TLS and sees an encrypted session to a hostname. Prompt content is visible only where the traffic is terminated and inspected deliberately, which is the structural point the LLM gateway security material develops.

Building the evidence the LGPD expects

Four records carry most of the weight, and all four have to be generated at the moment of the request.

The authorising identity, so accountability attaches to a person or a scoped service principal rather than to a process credential.

The content classification, applied before the call, which is what makes purpose limitation and necessity demonstrable rather than asserted.

The destination and operator, which supports the recipient record and any international transfer analysis.

The policy version and outcome, including refusals, which is how a controller demonstrates that a stated measure operated on a stated date.

The LGPD AI audit evidence piece covers the record structure, and the compliance checklist covers the wider programme. What I would push for first is the classification step, because without it every other record describes a transaction whose contents remain unknown.

DeepInspect

DeepInspect provides an independent policy decision at the HTTP AI request boundary. For traffic routed through it, DeepInspect evaluates the application-supplied identity and role against organisational policy for content classification and model authorisation before the request reaches the model.

Each decision produces a signed, tamper-evident record held outside the calling application's write path, covering permitted and refused requests alike. When a Brazilian controller is asked to demonstrate accountability for what its AI deployment disclosed and to whom, that record is the artefact that answers rather than describes.

Book a technical deep dive at deepinspect.ai.