Deffenti Lawyers · Data Protection
The Right to an Explanation in Automated Decision-Making: GDPR and LGPD Compared
Automated decision-making is routine in credit, insurance, recruitment and public benefit assessments. When those decisions carry legal or significant financial consequences, organisations are not free to rely on algorithms without accountability.
By Vanessa R. T. Borges · Deffenti Lawyers
Under the EU General Data Protection Regulation (GDPR), individuals have the right to know how automated decisions about them were made. Brazil’s Lei Geral de Proteção de Dados (LGPD) does not replicate article 22 of the GDPR in identical terms, but imposes broadly comparable obligations through its transparency and data subject rights framework.
Opaque models create a compliance problem: if an algorithm cannot be adequately explained, the organisation cannot lawfully use it for automated decisions with significant impact under either regime.
2. What Counts as a Significant Automated Decision?
Under the GDPR, significant decisions include those materially affecting financial situation, access to services or similar interests: credit scores, insurance pricing, automated recruitment shortlisting.
Under the LGPD, the threshold is broader: any decision made solely on automated processing that affects the data subject’s interests qualifies, arguably wider than the GDPR standard.
3. What Must the Explanation Cover?
General explanation (proactive)
Must describe: the fact of automated decision-making and any profiling; categories of data used; how factors are weighted in general terms; the legal basis; and the significance and expected consequences.
Personal explanation (on request)
Must cover: the specific data used as inputs; the essential elements of the algorithm applied, including weighting and intermediate outputs; and why the data produced that particular result.
The LGPD does not use this exact terminology, but the same structure follows from article 9 (proactive disclosure at collection) and Articles 18/20 (disclosure of data, logic and outcome on request).
5. Explaining the Logic: How Insightful Is the Model?
Model type
Characteristics
Explanation approach
Insightful
Linear, monotonous, non-complex. Small decision trees, rule-based systems, small regression models.
Explain directly: show the decision rules, formula or parameters.
Requires added techniques
Non-linear or complex models, large regressions, neural networks with limited detectable inputs.
Use factor weighting (e.g. SHAP) or comparative (counterfactual) explanations.
Opaque
Highly non-linear, many interacting parameters. Large neural networks; most large language models.
Cannot currently be explained sufficiently under the GDPR or LGPD transparency standard.
Factor weighting (e.g. SHAP) shows how much each variable contributed; comparative (counterfactual) explanations show what would have had to change for a different outcome. Neither is complete alone; organisations typically need both, plus context on the algorithm’s objectives.
Before deploying any automated decision-making system, organisations must satisfy themselves that adequate explanation is achievable. Complexity is not a defence: it is a risk to be managed at the design stage.
8. Governance: Building Explainability
Phase 1
Technique selection
Choose explanation techniques appropriate for the model and integrate them into decision-making and IT systems.
Phase 2
Delivery strategy
Develop a clear communication strategy, train staff handling access requests, and establish a contact point.
Phase 3
Evaluation
Test explanations with representative individuals, gather feedback, and review regularly as models change.
Under the GDPR, significant automated decisions typically require a Data Protection Impact Assessment (DPIA), the natural place to document explainability risk. The LGPD does not yet mandate an equivalent, though the ANPD encourages impact assessments for high-risk processing.
10. Frequently Asked Questions
Does the right to explanation apply to every automated decision?
No. Under the GDPR it applies to fully automated decisions with legal or similarly significant effects. Under the LGPD the threshold is broader (any decision affecting interests), but detailed ANPD guidance is still pending.
Is providing the algorithm’s formula a sufficient explanation?
No. The explanation must translate the algorithm’s operation into language the individual can act on, confirmed by the CJEU in Dun & Bradstreet (2025) and consistent with the LGPD’s transparency standard.
Can an organisation use a model it cannot explain?
Not for significant automated decisions under the GDPR, and not in practice under the LGPD’s transparency and accountability obligations. Choose a more explainable model, add sufficient transparency techniques, or ensure meaningful human involvement.
How quickly must an explanation be provided?
Under the GDPR, one month, extendable by two for complex cases. Under the LGPD, article 19 requires a response within 15 days, substantially shorter.
What penalties apply for failing to explain?
GDPR fines reach 4% of global turnover or EUR 20 million, whichever is higher. LGPD fines reach 2% of Brazilian revenues, capped at BRL 50 million per violation, plus daily fines, public disclosure and data blocking.
