{"id":6127,"date":"2026-04-29T00:49:58","date_gmt":"2026-04-29T03:49:58","guid":{"rendered":"https:\/\/deffenti.com\/?page_id=6127"},"modified":"2026-05-07T21:34:45","modified_gmt":"2026-05-08T00:34:45","slug":"automated-decision-making-under-lgpd","status":"publish","type":"page","link":"https:\/\/deffenti.com\/en\/automated-decision-making-under-lgpd\/","title":{"rendered":"Right to an Explanation in Automated Decision-Making"},"content":{"rendered":"<section data-bb-version=\"5.7.2\" id=\"bt_bb_section6ac8e7aca6871\" class=\"bt_bb_section bt_bb_layout_boxed_1200\"  data-bt-override-class=\"null\"><div class=\"bt_bb_port\"><div class=\"bt_bb_cell\"><div class=\"bt_bb_cell_inner\"><div class=\"bt_bb_row \"  data-bt-override-class=\"{}\"><div class=\"bt_bb_row_holder\" ><div data-bb-version=\"5.7.2\"  class=\"bt_bb_column col-xl-12 col-xs-12 col-sm-12 col-md-12 col-lg-12 bt_bb_align_left bt_bb_padding_normal\"  data-width=\"12\" data-bt-override-class=\"{}\"><div class=\"bt_bb_column_content bt_bb_vertical_align_top bt_bb_color_scheme_\"><div class=\"bt_bb_column_content_inner\"><div class=\"bt_bb_raw_content\"><!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"UTF-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n<link href=\"https:\/\/fonts.googleapis.com\/css2?family=Lato:ital,wght@0,100;0,300;0,400;0,700;0,900;1,100;1,300;1,400&display=swap\" rel=\"stylesheet\" \/>\n<style>\n :root{--navy:#0d1b2a;--navy-mid:#1a2e45;--gold:#cb8569;--gold-light:#e09a7e;--cream:#f8f5f0;--warm-white:#fdfcfa;--text-dark:#1a1a1a;--text-mid:#4a4a4a;--text-light:#7a7a7a;--border:#e0d8cc;}\n .dq-page-wrap{margin-left:calc(-50vw + 50%);margin-right:calc(-50vw + 50%);width:100vw;max-width:100vw;overflow-x:hidden;}\n *,*::before,*::after{box-sizing:border-box;margin:0;padding:0;}\n html{scroll-behavior:smooth;}\n body{font-family:'Lato',sans-serif;background:var(--warm-white);color:var(--text-dark);line-height:1.7;font-weight:400;}\n\n \/* HERO *\/\n .hero{background:var(--navy);color:white;padding:80px 40px 72px;position:relative;overflow:hidden;}\n .hero::after{content:'';position:absolute;bottom:0;left:0;right:0;height:3px;background:linear-gradient(90deg,transparent,var(--gold),transparent);}\n .hero-inner{max-width:860px;margin:0 auto;}\n .hero-label{font-size:11px;letter-spacing:3px;text-transform:uppercase;color:var(--gold-light);margin-bottom:24px;display:flex;align-items:center;gap:14px;}\n .hero-label::before{content:'';display:block;width:24px;height:1px;background:var(--gold-light);}\n .hero h1{font-size:clamp(24px,3.8vw,42px);font-weight:300;line-height:1.2;margin-bottom:24px;}\n .hero h1 em{font-style:italic;color:var(--gold-light);}\n .hero-deck{font-size:18px;color:rgba(255,255,255,0.68);line-height:1.75;max-width:700px;font-weight:300;margin-bottom:28px;}\n .hero-byline{font-size:13px;color:rgba(255,255,255,0.45);letter-spacing:0.3px;}\n .hero-byline a{color:var(--gold-light);text-decoration:none;}\n .hero-byline a:hover{color:white;}\n\n \/* SECTIONS *\/\n .article-section{padding:60px 40px;}\n .article-section.white{background:var(--warm-white);}\n .article-section.cream{background:var(--cream);}\n .article-section.navy-bg{background:var(--navy);}\n .article-inner{max-width:860px;margin:0 auto;}\n\n \/* TYPOGRAPHY *\/\n .lead{font-size:18px;color:var(--text-mid);line-height:1.9;margin-bottom:28px;}\n p{font-size:16px;color:var(--text-mid);line-height:1.9;margin-bottom:20px;}\n p:last-child{margin-bottom:0;}\n .article-section.navy-bg p{color:rgba(255,255,255,0.7);}\n .article-section.navy-bg strong{color:var(--gold-light);}\n\n h2.section-h{font-size:26px;font-weight:700;color:var(--navy);margin:0 0 24px;line-height:1.25;}\n h2.section-h::before{content:'';display:block;width:32px;height:2px;background:var(--gold);margin-bottom:14px;}\n h3.sub-h{font-size:19px;font-weight:700;color:var(--navy);margin:36px 0 14px;line-height:1.3;}\n \n\n \/* QUICK READ *\/\n .quick-read{background:var(--navy);padding:60px 40px;}\n .quick-read-inner{max-width:860px;margin:0 auto;}\n .quick-read-label{font-size:11px;letter-spacing:3px;text-transform:uppercase;color:var(--gold-light);margin-bottom:20px;display:flex;align-items:center;gap:14px;}\n .quick-read-label::before{content:'';display:block;width:24px;height:1px;background:var(--gold-light);}\n .quick-read-grid{display:grid;grid-template-columns:1fr 1fr;gap:2px;background:rgba(255,255,255,0.08);margin-top:8px;}\n .qr-item{background:var(--navy-mid);padding:24px 28px;}\n .qr-item-label{font-size:11px;font-weight:700;letter-spacing:2px;text-transform:uppercase;color:var(--gold);margin-bottom:8px;}\n .qr-item p{font-size:14px;color:rgba(255,255,255,0.6);line-height:1.75;margin:0;}\n\n \/* CALLOUT \/ PULL QUOTE *\/\n .callout{border-left:3px solid var(--gold);padding:20px 28px;margin:28px 0;}\n .article-section.white .callout{background:var(--cream);}\n .article-section.cream .callout{background:var(--warm-white);}\n .callout p{font-size:16px;color:var(--navy);font-style:italic;line-height:1.8;margin:0;}\n\n \/* BULLET LISTS *\/\n .body-list{list-style:none;margin:16px 0 24px;padding:0;}\n .body-list li{padding:8px 0 8px 22px;position:relative;font-size:16px;color:var(--text-mid);line-height:1.8;border-bottom:1px solid var(--border);}\n .body-list li:last-child{border-bottom:none;}\n .body-list li::before{content:'';position:absolute;left:0;top:17px;width:8px;height:2px;background:var(--gold);}\n\n \/* TABLES *\/\n .table-wrap{overflow-x:auto;margin:28px 0 36px;}\n table{width:100%;border-collapse:collapse;font-size:14px;}\n thead th{background:var(--navy);color:white;padding:12px 16px;text-align:left;font-size:11px;font-weight:700;letter-spacing:1.5px;text-transform:uppercase;}\n tbody tr{border-bottom:1px solid var(--border);}\n tbody tr:last-child{border-bottom:none;}\n tbody td{padding:13px 16px;color:var(--text-mid);vertical-align:top;line-height:1.7;}\n tbody tr:nth-child(even) td{background:var(--cream);}\n .article-section.cream tbody tr:nth-child(even) td{background:var(--warm-white);}\n .table-badge{display:inline-block;font-weight:700;color:var(--navy);}\n .table-badge.risk{color:#b03030;}\n .table-badge.ok{color:#2a6e35;}\n\n \/* PHASE LIST *\/\n .phase-list{list-style:none;margin:16px 0;border-top:1px solid var(--border);}\n .phase-list li{display:grid;grid-template-columns:auto 1fr;gap:16px 24px;padding:24px 0;border-bottom:1px solid var(--border);}\n .phase-num{font-size:11px;font-weight:700;letter-spacing:2px;text-transform:uppercase;color:var(--gold);padding-top:2px;white-space:nowrap;}\n .phase-content h4{font-size:15px;font-weight:700;color:var(--navy);margin-bottom:6px;}\n .phase-content p{font-size:15px;color:var(--text-mid);line-height:1.8;margin:0;}\n\n \/* FAQ *\/\n .faq-list{list-style:none;margin:0;}\n .faq-item{border-bottom:1px solid var(--border);padding:28px 0;}\n .faq-item:first-child{border-top:1px solid var(--border);}\n .faq-q{font-size:17px;font-weight:700;color:var(--navy);margin-bottom:12px;}\n \n .faq-a{font-size:15px;color:var(--text-mid);line-height:1.85;}\n\n \/* LINKS *\/\n a.ref{color:var(--gold);text-decoration:none;border-bottom:1px solid rgba(203,133,105,0.35);}\n a.ref:hover{color:var(--gold-light);border-bottom-color:var(--gold-light);}\n\n @media(max-width:760px){\n .hero,.article-section,.quick-read{padding-left:24px;padding-right:24px;}\n .hero{padding-top:56px;padding-bottom:52px;}\n .quick-read-grid{grid-template-columns:1fr;}\n .phase-list li{grid-template-columns:1fr;}\n table{font-size:13px;}\n thead th,tbody td{padding:10px 12px;}\n }\n<\/style>\n<\/head>\n<body>\n<div class=\"dq-page-wrap\">\n\n<!-- HERO -->\n<section class=\"hero\">\n <div class=\"hero-inner\">\n <div class=\"hero-label\">D&Q Lawyers \u00b7 Data Protection<\/div>\n <h1>The Right to an Explanation in<br><em>Automated Decision-Making<\/em>:<br>GDPR and LGPD Compared<\/h1>\n <p class=\"hero-deck\">Automated decision-making is routine in credit, insurance, recruitment, and public benefit assessments. When those decisions carry legal or significant financial consequences, organisations are not free to rely on algorithms without accountability.<\/p>\n <p class=\"hero-byline\">By <a href=\"https:\/\/www.linkedin.com\/in\/vanessa-ribeiro-teixeira-borges-52b4ba42\/?locale=en\">Vanessa R. T. Borges<\/a> \u00b7 D&Q Lawyers<\/p>\n <\/div>\n<\/section>\n\n<!-- QUICK READ -->\n<section class=\"quick-read\">\n <div class=\"quick-read-inner\">\n <div class=\"quick-read-label\">Quick Read<\/div>\n <div class=\"quick-read-grid\">\n <div class=\"qr-item\">\n <div class=\"qr-item-label\">Prohibition with exceptions<\/div>\n <p>Automated decisions with legal or significant effects are, in principle, prohibited under the <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\">GDPR<\/a> unless supported by law, contract necessity, or explicit consent. The <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a> takes a parallel approach through its transparency and rights framework.<\/p>\n <\/div>\n <div class=\"qr-item\">\n <div class=\"qr-item-label\">Two explanation levels<\/div>\n <p>A <em>general<\/em> explanation, provided proactively to all individuals; and a <em>specific<\/em> (personal) explanation, provided when an individual makes an access request.<\/p>\n <\/div>\n <div class=\"qr-item\">\n <div class=\"qr-item-label\">Technical accuracy is not enough<\/div>\n <p>Providing a mathematical formula does not satisfy the obligation. The individual must be able to understand the outcome and, if necessary, challenge it.<\/p>\n <\/div>\n <div class=\"qr-item\">\n <div class=\"qr-item-label\">Explainability must be built in<\/div>\n <p>Organisations that design automated decision-making processes without considering explanation will find compliance significantly harder to achieve under both regimes.<\/p>\n <\/div>\n <\/div>\n <\/div>\n<\/section>\n\n<!-- INTRO -->\n<section class=\"article-section white\">\n <div class=\"article-inner\">\n <p class=\"lead\">Under the EU <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\">General Data Protection Regulation (GDPR)<\/a>, individuals have the right to know how automated decisions about them were made and organisations have a legal obligation to explain. Brazil\u2019s <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">Lei Geral de Prote\u00e7\u00e3o de Dados (LGPD)<\/a> does not replicate <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:32016R0679#d1e3813-1-1\" class=\"ref\"><a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:32016R0679#d1e3813-1-1\" class=\"ref\">article 22<\/a> of the GDPR<\/a> in identical terms, but it imposes broadly comparable practical obligations through its transparency and data subject rights framework. Organisations operating across both jurisdictions must understand the similarities and the gaps.<\/p>\n\n <div class=\"callout\">\n <p>Opaque models create a compliance problem: if an algorithm cannot be adequately explained, the organisation cannot lawfully use it for automated decisions with significant impact under the <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\">GDPR<\/a>. Under the <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a>, the same issue creates significant compliance risk: if the controller cannot provide clear and adequate information about the criteria and procedures used, it may be unable to satisfy the transparency, accountability, and automated decision-review requirements.<\/p>\n <\/div>\n <\/div>\n<\/section>\n\n<!-- SECTION 1 -->\n<section class=\"article-section cream\">\n <div class=\"article-inner\">\n <h2 class=\"section-h\">1. When Does the Right to an Explanation Apply?<\/h2>\n\n <h3 class=\"sub-h\">The rule under the GDPR<\/h3>\n <p>The <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\">GDPR<\/a> prohibits fully automated decision-making where the decision produces legal effects for the individual or similarly significant effects, including decisions affecting access to credit, insurance, employment, or public services. Organisations can depart from this prohibition in three cases:<\/p>\n <ul class=\"body-list\">\n <li>a law specifically authorises the automated decision and provides appropriate safeguards;<\/li>\n <li>the decision is necessary for the performance of a contract with the individual; or<\/li>\n <li>the individual has given explicit consent.<\/li>\n <\/ul>\n <p>In each case, the organisation must take protective measures including providing an explanation of the decision.<\/p>\n\n <h3 class=\"sub-h\">The LGPD framework<\/h3>\n <p>Brazil\u2019s <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a> does not contain a provision equivalent to <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:32016R0679#d1e3813-1-1\" class=\"ref\"><a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:32016R0679#d1e3813-1-1\" class=\"ref\">article 22<\/a> GDPR<\/a> that expressly prohibits automated decision-making. However, the law creates parallel obligations through several interconnected provisions:<\/p>\n <ul class=\"body-list\">\n <li><strong><a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art20\" class=\"ref\">Article 20<\/a><\/strong> gives data subjects the right to request a review of any decision made solely on the basis of automated processing, including decisions that affect their interests, such as professional, consumer, credit, or personality profiles.<\/li>\n <li><strong>Articles 18 and 19<\/strong> establish data subject rights to access, correction, and portability, which apply directly to algorithmic outputs such as scores and categorisations.<\/li>\n <li><strong><a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art6\" class=\"ref\">Article 6<\/a><\/strong> requires that all personal data processing comply with the principles of purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, and accountability.<\/li>\n <li>Brazil\u2019s National Data Protection Authority (<a href=\"https:\/\/www.gov.br\/anpd\/pt-br\" class=\"ref\"><em>Autoridade Nacional de Prote\u00e7\u00e3o de Dados<\/em>, <strong>ANPD<\/strong><\/a>) is explicitly empowered under <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art20\" class=\"ref\">article 20<\/a>(2) to issue regulations on automated decision-making, signalling that more specific rules are expected.<\/li>\n <\/ul>\n <p>In practice, the LGPD\u2019s transparency principle and the right to review of automated decisions create an obligation functionally similar to the GDPR\u2019s explanation requirement. Organisations subject to both regimes will find that a GDPR-compliant explanation approach substantially addresses LGPD obligations, subject to the differences noted below.<\/p>\n <\/div>\n<\/section>\n\n<!-- SECTION 2 -->\n<section class=\"article-section white\">\n <div class=\"article-inner\">\n <h2 class=\"section-h\">2. What Counts as a Significant Automated Decision?<\/h2>\n <p>Under the <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\">GDPR<\/a>, significant decisions are not limited to formal legal determinations. They include decisions that materially affect an individual\u2019s financial situation, access to services, freedom of movement, or similar interests. A credit score that determines whether a loan is approved, an algorithm that prices an insurance premium, or an automated recruitment shortlisting tool all fall within scope.<\/p>\n <p>Under the <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a>, the threshold for the right to review is framed broadly: any decision made solely on the basis of automated processing that affects the data subject\u2019s interests qualifies. This formulation is at least as broad as the GDPR\u2019s, and arguably broader, since it is not restricted to decisions with legal or similarly significant effects.<\/p>\n <\/div>\n<\/section>\n\n<!-- SECTION 3 -->\n<section class=\"article-section cream\">\n <div class=\"article-inner\">\n <h2 class=\"section-h\">3. What Must the Explanation Cover?<\/h2>\n\n <h3 class=\"sub-h\">Two distinct obligations under the GDPR<\/h3>\n <p>Organisations subject to <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:32016R0679#d1e3813-1-1\" class=\"ref\">article 22<\/a> <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\">GDPR<\/a> must provide explanation at two levels: a <em>general<\/em> explanation, provided proactively and available before any specific decision is made; and a <em>specific (personal)<\/em> explanation, triggered when an individual makes an access request or invokes their rights.<\/p>\n\n <h3 class=\"sub-h\">General explanation: what it must contain<\/h3>\n <p>The general explanation must describe:<\/p>\n <ul class=\"body-list\">\n <li>the fact that automated decision-making is used, and whether profiling is involved;<\/li>\n <li>the categories of personal data taken into account (for example, age, income, driving history);<\/li>\n <li>how the different factors are weighted in general terms;<\/li>\n <li>the legal basis on which the automated decision is made; and<\/li>\n <li>the significance and expected consequences of the decision for individuals.<\/li>\n <\/ul>\n\n <h3 class=\"sub-h\">Personal explanation: what it must contain<\/h3>\n <p>The personal explanation must go further and cover:<\/p>\n <ul class=\"body-list\">\n <li>the specific personal data used as inputs in the individual\u2019s decision;<\/li>\n <li>the essential elements of the algorithm applied to that decision, including the weighting of factors, the steps followed, and any intermediate outputs such as scores or category assignments; and<\/li>\n <li>the relationship between the data and the outcome, in other words why the data produced the result it did.<\/li>\n <\/ul>\n <p>It is good practice to provide both levels together in response to an access request: a personal explanation of the specific outcome, with a reference to the general explanation for context on how the system works overall.<\/p>\n\n <h3 class=\"sub-h\">The LGPD parallel<\/h3>\n <p>The <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a>\u2019s framework does not use the distinction between general and personal explanations in the same explicit terms, but the same structure emerges from its rights framework. Under <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art9\" class=\"ref\">article 9<\/a>, controllers must inform data subjects of the purpose and form of processing at the time of data collection. Under <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art18\" class=\"ref\">Articles 18 and 20<\/a>, data subjects can request access to their data and a review of automated decisions. Together, these provisions require:<\/p>\n <ul class=\"body-list\">\n <li>proactive disclosure of the use of automated processing and its purposes (equivalent to the general explanation); and<\/li>\n <li>on request, disclosure of the specific data used, the logic applied, and how those factors produced the outcome (equivalent to the personal explanation).<\/li>\n <\/ul>\n <\/div>\n<\/section>\n\n<!-- SECTION 4 -->\n<section class=\"article-section white\">\n <div class=\"article-inner\">\n <h2 class=\"section-h\">4. What Does the Explanation Have to Look Like?<\/h2>\n\n <h3 class=\"sub-h\">Useful, not just technical<\/h3>\n <p>The <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\">GDPR<\/a> requires information to be provided in a concise, transparent, intelligible and easily accessible form, in clear and plain language. A technically accurate description of an algorithm is not sufficient. The <a href=\"https:\/\/curia.europa.eu\/juris\/liste.jsf?num=C-203\/22\" class=\"ref\">Court of Justice of the EU<\/a> confirmed in <a href=\"https:\/\/curia.europa.eu\/juris\/liste.jsf?num=C-203\/22\" class=\"ref\"><em>Dun & Bradstreet<\/em> (C-203\/22, February 2025)<\/a> that a complex algorithm, or a step-by-step description of all its operations, is neither concise nor comprehensible. The test is whether the individual can actually understand why the decision was made and, if they disagree, how to challenge it.<\/p>\n\n <div class=\"callout\">\n <p>A useful rule of thumb: the explanation should be comparable to what a person who made the same decision manually would say if asked to justify it.<\/p>\n <\/div>\n\n <p>The <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a>\u2019s transparency principle (<a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art6\" class=\"ref\"><a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art6\" class=\"ref\">article 6<\/a>, IV<\/a>) reaches the same outcome. The <a href=\"https:\/\/www.gov.br\/anpd\/pt-br\" class=\"ref\">ANPD<\/a> has confirmed that transparency means providing clear, accessible and accurate information, not a technical description that the data subject cannot act on.<\/p>\n\n <h3 class=\"sub-h\">Language and accessibility<\/h3>\n <p>Under both regimes, organisations must:<\/p>\n <ul class=\"body-list\">\n <li>avoid technical jargon, acronyms and internal terminology;<\/li>\n <li>avoid vague language such as \"may\", \"could\" or \"possibly\";<\/li>\n <li>write at a reading level appropriate to the audience; and<\/li>\n <li>test the explanation with real members of the relevant audience and remain open to feedback.<\/li>\n <\/ul>\n\n <h3 class=\"sub-h\">Layered explanations<\/h3>\n <p>Where complete conciseness and completeness are difficult to achieve simultaneously, a layered approach can help. The first layer presents the key information: the fact of automated decision-making, the outcome, its consequences, and the individual\u2019s rights. A second layer, accessible on request or via a link, provides the more detailed technical explanation. This approach is endorsed in regulatory guidance under both the <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\">GDPR<\/a> and, by analogy, the <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a>.<\/p>\n <\/div>\n<\/section>\n\n<!-- SECTION 5: MODEL TABLE -->\n<section class=\"article-section cream\">\n <div class=\"article-inner\">\n <h2 class=\"section-h\">5. Explaining the Logic: How Insightful Is the Model?<\/h2>\n <p>How easily an automated decision can be explained depends substantially on the design of the model used. Organisations should understand where their models sit on the spectrum from transparent to opaque and what that means for their ability to fulfil their obligations.<\/p>\n\n <div class=\"table-wrap\">\n <table>\n <thead>\n <tr>\n <th>Model type<\/th>\n <th>Characteristics<\/th>\n <th>Explanation approach<\/th>\n <\/tr>\n <\/thead>\n <tbody>\n <tr>\n <td><span class=\"table-badge ok\">Insightful<\/span><\/td>\n <td>Linear, monotonous, non-complex. Small decision trees, rule-based systems, small regression models.<\/td>\n <td>Explain directly: show the decision rules, formula or parameters.<\/td>\n <\/tr>\n <tr>\n <td><span class=\"table-badge\">Requires additional techniques<\/span><\/td>\n <td>Non-linear or complex models, large regressions, neural networks with limited detectable inputs.<\/td>\n <td>Use factor weighting (e.g. <a href=\"https:\/\/shap.readthedocs.io\/en\/latest\/\" class=\"ref\">SHAP<\/a>) or comparative (counterfactual) explanations.<\/td>\n <\/tr>\n <tr>\n <td><span class=\"table-badge risk\">Opaque<\/span><\/td>\n <td>Highly non-linear, non-monotonous, many interacting parameters. Large neural networks; most large language models.<\/td>\n <td>Cannot currently be explained sufficiently under the <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\">GDPR<\/a> or <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a> transparency standard.<\/td>\n <\/tr>\n <\/tbody>\n <\/table>\n <\/div>\n\n <h3 class=\"sub-h\">Insightful models<\/h3>\n <p>A model is insightful when changes in the input have a direct, predictable effect on the outcome; when the direction of that effect is consistent; and when the number of interacting factors is small enough to follow. Rule-based systems, small decision trees and simple regression models typically fall into this category. Their logic can be explained directly by showing the rules, the formula, or the decision tree.<\/p>\n\n <h3 class=\"sub-h\">Models that can be made transparent<\/h3>\n <p>Many models in commercial use are too complex to follow step by step but can be made more transparent through supplementary techniques. Two categories are most commonly used:<\/p>\n <ul class=\"body-list\">\n <li><strong>Factor weighting<\/strong> shows how much each input variable contributed to the specific outcome. Tools such as <a href=\"https:\/\/shap.readthedocs.io\/en\/latest\/\" class=\"ref\">SHAP (SHapley Additive exPlanations)<\/a> calculate the average effect of each factor, making it possible to tell an individual: \u201cYour application was rejected primarily because of the loan amount requested, relative to your income.\u201d Factor weighting must be calculated for the individual decision, not just presented as a general model summary.<\/li>\n <li><strong>Comparative (counterfactual) explanations<\/strong> show what would have had to change in the individual\u2019s data for the outcome to have been different. For example: \u201cIf your annual income had been R$120,000 rather than R$80,000, or if the loan amount requested had been R$25,000 rather than R$50,000, the application would have been approved.\u201d Comparative explanations give the individual a basis for action and for challenging the decision.<\/li>\n <\/ul>\n <p>Neither technique is a complete solution on its own. Organisations will typically need to combine both, supplemented by information about the algorithm\u2019s objectives, the full set of factors considered, and the relationship between factors and outcome.<\/p>\n\n <h3 class=\"sub-h\">Opaque models and the compliance problem<\/h3>\n <p>Some algorithms (particularly large neural networks and large language models) are too complex to explain adequately using any available technique. Organisations that wish to use such systems for automated decisions with significant impact face a fundamental compliance problem under both the <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\">GDPR<\/a> and the <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a>: if the model cannot be explained, the obligation to explain cannot be met.<\/p>\n <div class=\"callout\">\n <p>Before deploying any automated decision-making system, organisations must satisfy themselves that adequate explanation is achievable. Complexity is not a defence: it is a risk to be managed at the design stage.<\/p>\n <\/div>\n <\/div>\n<\/section>\n\n<!-- SECTION 6: COMPARISON TABLE -->\n<section class=\"article-section white\">\n <div class=\"article-inner\">\n <h2 class=\"section-h\">6. GDPR and LGPD: A Comparative Overview<\/h2>\n <p>The table below summarises the key differences between the <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\">GDPR<\/a> and <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a> frameworks for automated decision-making. Organisations operating across both jurisdictions should use this as the basis for a gap analysis, not a substitute for legal advice on specific circumstances.<\/p>\n\n <div class=\"table-wrap\">\n <table>\n <thead>\n <tr>\n <th>Topic<\/th>\n <th><a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\" style=\"color:var(--gold-light);\">GDPR (EU)<\/a><\/th>\n <th><a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\" style=\"color:var(--gold-light);\">LGPD (Brazil)<\/a><\/th>\n <\/tr>\n <\/thead>\n <tbody>\n <tr>\n <td><strong>Specific prohibition on automated decisions<\/strong><\/td>\n <td>Yes. <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:32016R0679#d1e3813-1-1\" class=\"ref\">Article 22<\/a> prohibits decisions producing legal or significant effects, subject to three exceptions.<\/td>\n <td>No equivalent express prohibition, but <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art20\" class=\"ref\">article 20<\/a> grants the right to review of automated decisions affecting the data subject\u2019s interests.<\/td>\n <\/tr>\n <tr>\n <td><strong>Scope of trigger<\/strong><\/td>\n <td>Legal effects or similarly significant effects.<\/td>\n <td>Decisions affecting the data subject\u2019s interests; arguably broader than the GDPR threshold.<\/td>\n <\/tr>\n <tr>\n <td><strong>Right to explanation<\/strong><\/td>\n <td>Not framed as a standalone right, but derived from <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:32016R0679#d1e1467-1-1\" class=\"ref\">Articles 13, 14, 15 and 22<\/a>, Recital 71, and confirmed by the <a href=\"https:\/\/curia.europa.eu\/juris\/liste.jsf?num=C-203\/22\" class=\"ref\">CJEU in <em>Dun & Bradstreet<\/em><\/a>.<\/td>\n <td>Implicit through Articles 9, 18 and 20; <a href=\"https:\/\/www.gov.br\/anpd\/pt-br\" class=\"ref\">ANPD<\/a> expected to issue further specific regulation.<\/td>\n <\/tr>\n <tr>\n <td><strong>General (proactive) explanation<\/strong><\/td>\n <td>Required under Articles 13 and 14 at or before data collection.<\/td>\n <td>Required under <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art9\" class=\"ref\">article 9<\/a> (purpose and transparency) and the general transparency principle.<\/td>\n <\/tr>\n <tr>\n <td><strong>Personal (specific) explanation<\/strong><\/td>\n <td>Required on access request under <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:32016R0679#d1e1634-1-1\" class=\"ref\">article 15<\/a>; confirmed by <a href=\"https:\/\/curia.europa.eu\/juris\/liste.jsf?num=C-203\/22\" class=\"ref\">CJEU in <em>Dun & Bradstreet<\/em> (2025)<\/a>.<\/td>\n <td>Available under <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art20\" class=\"ref\">article 20<\/a> right to review and <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art18\" class=\"ref\">article 18<\/a> right of access.<\/td>\n <\/tr>\n <tr>\n <td><strong>Human review right<\/strong><\/td>\n <td>Mandatory under <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:32016R0679#d1e3813-1-1\" class=\"ref\"><a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:32016R0679#d1e3813-1-1\" class=\"ref\">article 22<\/a>(3)<\/a>: right to human intervention, to express a view, and to challenge the decision.<\/td>\n <td><a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art20\" class=\"ref\">Article 20<\/a>: right to request review. The LGPD does not currently require that the review be conducted by a human, although this may be necessary or advisable in higher-risk cases.<\/td>\n <\/tr>\n <tr>\n <td><strong>Legal bases for processing<\/strong><\/td>\n <td>6 legal bases under <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art6\" class=\"ref\">article 6<\/a> <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\">GDPR<\/a>.<\/td>\n <td>10 legal bases under <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art7\" class=\"ref\">article 7<\/a> <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a>, including \u201clegitimate interest\u201d and \u201ccredit protection\u201d.<\/td>\n <\/tr>\n <tr>\n <td><strong>Enforcement authority<\/strong><\/td>\n <td>EU member state data protection authorities (e.g. <a href=\"https:\/\/www.cnil.fr\/en\/home\" class=\"ref\">CNIL<\/a>, <a href=\"https:\/\/ico.org.uk\/\" class=\"ref\">ICO<\/a>, <a href=\"https:\/\/www.datatilsynet.no\/en\/\" class=\"ref\">Datatilsynet<\/a>); significant enforcement record.<\/td>\n <td><a href=\"https:\/\/www.gov.br\/anpd\/pt-br\" class=\"ref\">ANPD<\/a>; enforcement increasingly active since 2023; first sanctions issued.<\/td>\n <\/tr>\n <tr>\n <td><strong>Maximum penalty<\/strong><\/td>\n <td>4% of global annual turnover or EUR 20 million, whichever is higher.<\/td>\n <td>2% of Brazilian revenues (prior year), capped at BRL 50 million per violation.<\/td>\n <\/tr>\n <tr>\n <td><strong>Explainability-by-design<\/strong><\/td>\n <td>Derived from data protection by design (<a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:32016R0679#d1e2544-1-1\" class=\"ref\">article 25<\/a> <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\">GDPR<\/a>).<\/td>\n <td>Derived from accountability and prevention principles (<a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art6\" class=\"ref\">article 6<\/a> <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a>).<\/td>\n <\/tr>\n <\/tbody>\n <\/table>\n <\/div>\n <\/div>\n<\/section>\n\n<!-- SECTION 7 -->\n<section class=\"article-section cream\">\n <div class=\"article-inner\">\n <h2 class=\"section-h\">7. Limits on the Obligation to Explain<\/h2>\n\n <h3 class=\"sub-h\">Trade secrets<\/h3>\n <p>Where a complete explanation would require disclosure of genuinely protected trade secret information, the organisation may limit the explanation to avoid that disclosure. However, a general concern about commercial sensitivity is not sufficient. The organisation must demonstrate that the information is legally protected, that disclosure would cause concrete harm, and that the limitation is proportionate. Trade secrecy limits what must be disclosed, not whether an explanation must be given at all.<\/p>\n <p>The <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a> does not contain an equivalent express exception for trade secrets in the context of the <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art20\" class=\"ref\">article 20<\/a> right to review. However, the general principle of balancing conflicting rights, established in <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art18\" class=\"ref\"><a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art18\" class=\"ref\">article 18<\/a>(3)<\/a> and developed by the <a href=\"https:\/\/www.gov.br\/anpd\/pt-br\" class=\"ref\">ANPD<\/a> in regulatory guidance, achieves a similar result. An organisation that cannot disclose its algorithm may still be required to describe what the algorithm does and what factors it considered.<\/p>\n\n <h3 class=\"sub-h\">Gaming the system<\/h3>\n <p>An organisation may withhold specific information where disclosure would allow individuals to manipulate the decision-making process, for example in fraud detection systems where knowledge of the detection criteria would enable circumvention. A general concern is not enough; the risk must be concrete and the withholding proportionate. Both the <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\">GDPR<\/a> and <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a> frameworks support this balancing exercise.<\/p>\n\n <h3 class=\"sub-h\">Procedural requirements when limiting explanation<\/h3>\n <p>When an organisation limits an explanation, it must in both jurisdictions:<\/p>\n <ul class=\"body-list\">\n <li>inform the individual that the explanation has been limited;<\/li>\n <li>explain the reasons for the limitation; and<\/li>\n <li>inform the individual of their right to complain to the relevant supervisory authority (the <a href=\"https:\/\/www.gov.br\/anpd\/pt-br\" class=\"ref\">ANPD<\/a> or the competent EU data protection authority) and to seek judicial remedy.<\/li>\n <\/ul>\n <\/div>\n<\/section>\n\n<!-- SECTION 8 -->\n<section class=\"article-section white\">\n <div class=\"article-inner\">\n <h2 class=\"section-h\">8. Governance: Building Explainability<\/h2>\n\n <h3 class=\"sub-h\">Explainability-by-design<\/h3>\n <p>Both the <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\">GDPR<\/a>\u2019s data protection by design principle (<a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:32016R0679#d1e2544-1-1\" class=\"ref\">article 25<\/a>) and the <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a>\u2019s accountability and prevention principles (<a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art6\" class=\"ref\">article 6<\/a>) require organisations to consider explainability from the outset, not as an afterthought. In practice, this means making conscious choices at the design stage about which type of algorithm to use, confirming that adequate explanation is achievable, and documenting those choices.<\/p>\n\n <h3 class=\"sub-h\">A three-phase explanation process<\/h3>\n <ul class=\"phase-list\">\n <li>\n <span class=\"phase-num\">Phase 1<\/span>\n <div class=\"phase-content\">\n <h4>Technique selection<\/h4>\n <p>Choose which explanation techniques are appropriate for the model in use. Determine how those techniques will be integrated into the decision-making process and IT systems.<\/p>\n <\/div>\n <\/li>\n <li>\n <span class=\"phase-num\">Phase 2<\/span>\n <div class=\"phase-content\">\n <h4>Delivery strategy<\/h4>\n <p>Develop a strategy for communicating explanations clearly and simply. Train the staff responsible for responding to access requests. Establish a contact point for individual queries.<\/p>\n <\/div>\n <\/li>\n <li>\n <span class=\"phase-num\">Phase 3<\/span>\n <div class=\"phase-content\">\n <h4>Evaluation<\/h4>\n <p>Test explanations with representative members of the relevant audience. Gather feedback. Review the process regularly, particularly when the underlying model changes.<\/p>\n <\/div>\n <\/li>\n <\/ul>\n\n <h3 class=\"sub-h\">DPIAs and the LGPD equivalent<\/h3>\n <p>Under the <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\">GDPR<\/a>, automated decision-making with significant impact will typically require a Data Protection Impact Assessment (<strong>DPIA<\/strong>). The DPIA is the appropriate place to document the organisation\u2019s assessment of explainability risks and the measures taken to address them.<\/p>\n <p>The <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a> does not yet have a mandatory DPIA equivalent in the same terms, though the <a href=\"https:\/\/www.gov.br\/anpd\/pt-br\" class=\"ref\">ANPD<\/a> has issued guidance encouraging impact assessments for high-risk processing. Organisations already conducting DPIAs for GDPR purposes should extend their explainability documentation to cover LGPD compliance as part of the same exercise.<\/p>\n <\/div>\n<\/section>\n\n<!-- SECTION 9: RIGHTS TABLE -->\n<section class=\"article-section cream\">\n <div class=\"article-inner\">\n <h2 class=\"section-h\">9. Rights of Individuals<\/h2>\n <p>When an automated decision is made about an individual, that individual has specific rights under both regimes. The explanation is the mechanism that makes those rights meaningful: without it, an individual cannot know whether the decision was based on correct data, whether the algorithm applied relevant factors fairly, or whether there are grounds to challenge the outcome.<\/p>\n\n <div class=\"table-wrap\">\n <table>\n <thead>\n <tr>\n <th>Right<\/th>\n <th><a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\" style=\"color:var(--gold-light);\">GDPR<\/a><\/th>\n <th><a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\" style=\"color:var(--gold-light);\">LGPD<\/a><\/th>\n <\/tr>\n <\/thead>\n <tbody>\n <tr>\n <td><strong>Human review<\/strong><\/td>\n <td><a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:32016R0679#d1e3813-1-1\" class=\"ref\">Article 22<\/a>(3): right to obtain human intervention in the decision.<\/td>\n <td><a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art20\" class=\"ref\">Article 20<\/a>: right to request review of the automated decision.<\/td>\n <\/tr>\n <tr>\n <td><strong>Express a view<\/strong><\/td>\n <td><a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:32016R0679#d1e3813-1-1\" class=\"ref\">Article 22<\/a>(3): right to express one\u2019s point of view before a final decision.<\/td>\n <td>General principle; no express provision equivalent to <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:32016R0679#d1e3813-1-1\" class=\"ref\"><a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:32016R0679#d1e3813-1-1\" class=\"ref\">article 22<\/a>(3)<\/a>.<\/td>\n <\/tr>\n <tr>\n <td><strong>Challenge the decision<\/strong><\/td>\n <td><a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:32016R0679#d1e3813-1-1\" class=\"ref\">Article 22<\/a>(3): right to contest the decision.<\/td>\n <td><a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art20\" class=\"ref\">Article 20<\/a>: right to request review and correction; right to complain to the <a href=\"https:\/\/www.gov.br\/anpd\/pt-br\" class=\"ref\">ANPD<\/a>.<\/td>\n <\/tr>\n <tr>\n <td><strong>Access to data and logic<\/strong><\/td>\n <td><a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:32016R0679#d1e1634-1-1\" class=\"ref\">Article 15<\/a>: right of access includes explanation of the automated decision.<\/td>\n <td><a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art18\" class=\"ref\">Articles 18 and 20<\/a>: right to access data and request review of automated processing.<\/td>\n <\/tr>\n <tr>\n <td><strong>Correction<\/strong><\/td>\n <td>Article 16: right to rectification of inaccurate data.<\/td>\n <td><a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art18\" class=\"ref\"><a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art18\" class=\"ref\">Article 18<\/a>(III)<\/a>: right to correction of incomplete, inaccurate or outdated data.<\/td>\n <\/tr>\n <tr>\n <td><strong>Portability<\/strong><\/td>\n <td><a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art20\" class=\"ref\">Article 20<\/a>: right to data portability.<\/td>\n <td><a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art18\" class=\"ref\">Article 18<\/a>(V): right to data portability.<\/td>\n <\/tr>\n <\/tbody>\n <\/table>\n <\/div>\n <\/div>\n<\/section>\n\n<!-- SECTION 10: FAQ -->\n<section class=\"article-section white\">\n <div class=\"article-inner\">\n <h2 class=\"section-h\">10. Frequently Asked Questions<\/h2>\n <ul class=\"faq-list\">\n <li class=\"faq-item\">\n <div class=\"faq-q\">Does the right to explanation apply to every automated decision?<\/div>\n <div class=\"faq-a\"><p>No. Under the <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\">GDPR<\/a>, it applies to fully automated decisions that produce legal effects or similarly significant effects. Decisions made with meaningful human involvement are generally outside scope. Under the <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a>, the threshold is broader (any automated decision affecting the data subject\u2019s interests), but the <a href=\"https:\/\/www.gov.br\/anpd\/pt-br\" class=\"ref\">ANPD<\/a> has not yet issued detailed implementing guidance.<\/p><\/div>\n <\/li>\n <li class=\"faq-item\">\n <div class=\"faq-q\">Is providing the algorithm\u2019s formula a sufficient explanation?<\/div>\n <div class=\"faq-a\"><p>No. A mathematical formula tells most individuals nothing they can act on. The explanation must translate the algorithm\u2019s operation into language that enables the individual to understand the outcome and, if necessary, challenge it. This was confirmed by the <a href=\"https:\/\/curia.europa.eu\/juris\/liste.jsf?num=C-203\/22\" class=\"ref\">CJEU in <em>Dun & Bradstreet<\/em> (2025)<\/a> for GDPR purposes and is consistent with the <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a>\u2019s transparency standard.<\/p><\/div>\n <\/li>\n <li class=\"faq-item\">\n <div class=\"faq-q\">Can an organisation use a model it cannot explain?<\/div>\n <div class=\"faq-a\"><p>Not for automated decisions with significant impact under the <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\">GDPR<\/a>. Not, in practice, for automated decisions affecting data subjects under the <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a>, given the transparency and accountability obligations. The organisation must either choose a more explainable model, implement sufficient transparency techniques, or ensure meaningful human involvement in the decision.<\/p><\/div>\n <\/li>\n <li class=\"faq-item\">\n <div class=\"faq-q\">How quickly must an explanation be provided?<\/div>\n <div class=\"faq-a\"><p>Under the <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\">GDPR<\/a>, an access request must be answered within <strong>one month<\/strong>, extendable by a further two months for complex cases. Under the <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a>, <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm#art19\" class=\"ref\">article 19<\/a> requires that access requests be responded to within <strong>15 days<\/strong>. The LGPD timeline is substantially shorter and must be factored into operational planning.<\/p><\/div>\n <\/li>\n <li class=\"faq-item\">\n <div class=\"faq-q\">What penalties apply for failing to explain?<\/div>\n <div class=\"faq-a\"><p>Under the <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32016R0679\" class=\"ref\">GDPR<\/a>, supervisory authorities may impose fines of up to <strong>4% of global annual turnover or EUR 20 million per violation<\/strong>, whichever is higher. Under the <a href=\"https:\/\/www.planalto.gov.br\/ccivil_03\/_ato2015-2018\/2018\/lei\/l13709.htm\" class=\"ref\">LGPD<\/a>, the <a href=\"https:\/\/www.gov.br\/anpd\/pt-br\" class=\"ref\">ANPD<\/a> can impose fines of up to <strong>2% of Brazilian revenues (prior year), capped at BRL 50 million per violation<\/strong>, as well as daily fines for ongoing non-compliance, public disclosure of the violation, and data blocking or deletion.<\/p><\/div>\n <\/li>\n <\/ul>\n <\/div>\n<\/section>\n\n<!-- CTA -->\n<section class=\"article-section navy-bg\">\n <div class=\"article-inner\" style=\"text-align:center;\">\n <div style=\"font-size:12px;letter-spacing:3px;text-transform:uppercase;color:var(--gold-light);margin-bottom:18px;display:flex;align-items:center;justify-content:center;gap:14px;\"><span style=\"display:block;width:24px;height:1px;background:var(--gold-light);\"><\/span>Get in touch<span style=\"display:block;width:24px;height:1px;background:var(--gold-light);\"><\/span><\/div>\n <h2 style=\"font-size:34px;font-weight:300;color:white;margin-bottom:20px;line-height:1.2;\">Using automated decisions in Brazil or the EU?<\/h2>\n <p style=\"font-size:16px;color:rgba(255,255,255,0.65);max-width:580px;margin:0 auto 40px;line-height:1.85;\">We advise organisations on LGPD and GDPR compliance, including automated decision-making obligations, explainability frameworks, and data subject rights. This article is a general overview and does not constitute legal advice. Contact us to discuss your situation.<\/p>\n <div style=\"padding:36px 44px;background:var(--navy-mid);display:inline-block;min-width:320px;\">\n <div style=\"font-size:12px;text-transform:uppercase;letter-spacing:2px;color:rgba(255,255,255,0.45);margin-bottom:12px;\">Contact<\/div>\n <a href=\"mailto:info@deqlaw.com.br\" style=\"font-size:22px;font-weight:300;color:white;text-decoration:none;display:block;margin-bottom:16px;\">info@deqlaw.com.br<\/a>\n <a href=\"mailto:info@deqlaw.com.br\" style=\"display:inline-block;background:var(--gold);color:#fff;text-decoration:none;padding:15px 38px;font-size:14px;font-weight:500;letter-spacing:1.5px;text-transform:uppercase;\">Send a message<\/a>\n <\/div>\n <\/div>\n<\/section>\n\n<\/div>\n<\/body>\n<\/html><\/div><\/div><\/div><\/div><\/div><\/div><\/div><!-- cell_inner --><\/div><!-- cell --><\/div><!-- port --><\/section>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":6,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-6127","page","type-page","status-publish","hentry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Right to an Explanation in Automated Decision-Making - D&amp;Q Lawyers<\/title>\n<meta name=\"description\" content=\"Compare GDPR and Brazil\u2019s LGPD rules on automated decision-making, explainability, human review and data subject rights for companies using AI.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/deffenti.com\/en\/automated-decision-making-under-lgpd\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Right to an Explanation in Automated Decision-Making - D&amp;Q Lawyers\" \/>\n<meta property=\"og:description\" content=\"Compare GDPR and Brazil\u2019s LGPD rules on automated decision-making, explainability, human review and data subject rights for companies using AI.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/deffenti.com\/en\/automated-decision-making-under-lgpd\/\" \/>\n<meta property=\"og:site_name\" content=\"D&amp;Q Lawyers\" \/>\n<meta property=\"article:modified_time\" content=\"2026-05-08T00:34:45+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"20 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/deffenti.com\\\/en\\\/automated-decision-making-under-lgpd\\\/\",\"url\":\"https:\\\/\\\/deffenti.com\\\/en\\\/automated-decision-making-under-lgpd\\\/\",\"name\":\"Right to an Explanation in Automated Decision-Making - D&amp;Q Lawyers\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/deffenti.com\\\/#website\"},\"datePublished\":\"2026-04-29T03:49:58+00:00\",\"dateModified\":\"2026-05-08T00:34:45+00:00\",\"description\":\"Compare GDPR and Brazil\u2019s LGPD rules on automated decision-making, explainability, human review and data subject rights for companies using AI.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/deffenti.com\\\/en\\\/automated-decision-making-under-lgpd\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/deffenti.com\\\/en\\\/automated-decision-making-under-lgpd\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/deffenti.com\\\/en\\\/automated-decision-making-under-lgpd\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"In\u00edcio\",\"item\":\"https:\\\/\\\/deffenti.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Right to an Explanation in Automated Decision-Making\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/deffenti.com\\\/#website\",\"url\":\"https:\\\/\\\/deffenti.com\\\/\",\"name\":\"D&amp;Q Lawyers\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/deffenti.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Right to an Explanation in Automated Decision-Making - D&amp;Q Lawyers","description":"Compare GDPR and Brazil\u2019s LGPD rules on automated decision-making, explainability, human review and data subject rights for companies using AI.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/deffenti.com\/en\/automated-decision-making-under-lgpd\/","og_locale":"en_US","og_type":"article","og_title":"Right to an Explanation in Automated Decision-Making - D&amp;Q Lawyers","og_description":"Compare GDPR and Brazil\u2019s LGPD rules on automated decision-making, explainability, human review and data subject rights for companies using AI.","og_url":"https:\/\/deffenti.com\/en\/automated-decision-making-under-lgpd\/","og_site_name":"D&amp;Q Lawyers","article_modified_time":"2026-05-08T00:34:45+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"20 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/deffenti.com\/en\/automated-decision-making-under-lgpd\/","url":"https:\/\/deffenti.com\/en\/automated-decision-making-under-lgpd\/","name":"Right to an Explanation in Automated Decision-Making - D&amp;Q Lawyers","isPartOf":{"@id":"https:\/\/deffenti.com\/#website"},"datePublished":"2026-04-29T03:49:58+00:00","dateModified":"2026-05-08T00:34:45+00:00","description":"Compare GDPR and Brazil\u2019s LGPD rules on automated decision-making, explainability, human review and data subject rights for companies using AI.","breadcrumb":{"@id":"https:\/\/deffenti.com\/en\/automated-decision-making-under-lgpd\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/deffenti.com\/en\/automated-decision-making-under-lgpd\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/deffenti.com\/en\/automated-decision-making-under-lgpd\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"In\u00edcio","item":"https:\/\/deffenti.com\/en\/"},{"@type":"ListItem","position":2,"name":"Right to an Explanation in Automated Decision-Making"}]},{"@type":"WebSite","@id":"https:\/\/deffenti.com\/#website","url":"https:\/\/deffenti.com\/","name":"D&amp;Q Lawyers","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/deffenti.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_hostinger_reach_plugin_has_subscription_block":false,"_hostinger_reach_plugin_is_elementor":false,"_links":{"self":[{"href":"https:\/\/deffenti.com\/en\/wp-json\/wp\/v2\/pages\/6127","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/deffenti.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/deffenti.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/deffenti.com\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/deffenti.com\/en\/wp-json\/wp\/v2\/comments?post=6127"}],"version-history":[{"count":3,"href":"https:\/\/deffenti.com\/en\/wp-json\/wp\/v2\/pages\/6127\/revisions"}],"predecessor-version":[{"id":6165,"href":"https:\/\/deffenti.com\/en\/wp-json\/wp\/v2\/pages\/6127\/revisions\/6165"}],"wp:attachment":[{"href":"https:\/\/deffenti.com\/en\/wp-json\/wp\/v2\/media?parent=6127"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}