Violation 01
Improper international transfer
By sending data to APIs in the USA without specific contracts or consent, you violate art. 33 of LGPD.
AI has transformed productivity — but it's created a silent nightmare for compliance: Shadow AI. Employees pasting customer data, financial spreadsheets, and source code into ChatGPT, with nobody authorizing it.
LGPD demands basic principles that tools like ChatGPT, Gemini, and Claude violate daily inside Brazilian companies. It's not interpretation — it's in the text of the law.
By sending data to APIs in the USA without specific contracts or consent, you violate art. 33 of LGPD.
An employee using ChatGPT to summarize a confidential contract is using a data processor for a purpose not stated in your privacy policy.
If an agent makes a decision about your customer (e.g., denies a benefit), LGPD requires the right to an explanation. Black-box AI doesn't allow that.
Can you guarantee that OpenAI or Google are not keeping your customers' data? Terms change — and the burden of proof is on you.
Blocking ChatGPT on your office network doesn't work — the team will use their phones. You need a data governance pipeline for AI. MDA's Definitive Checklist covers the 6 fronts your DPO needs to audit.
How to identify where company data is being entered into AI without authorization. Discovery roadmap + interviews.
Which legal basis to use for processing data via AI — Consent vs. Legitimate Interest — and how to document for audit.
What to require from AI vendors (OpenAI, Anthropic, etc.) to comply with ANPD. Mandatory clauses.
Technical checklist for anonymization and pseudonymization before LLM input. CPF, CNPJ, sensitive data.
The migration roadmap to SLMs in private cloud (Brazil data center) that eliminates 90% of LGPD risk in one shot.
Template for AI terms of use for employees + executive memo + minimal training. Ready to deploy.
Compliance is cheaper than the fine. The Checklist is a practical document for DPOs, CIOs, and General Counsels to audit and bring AI into compliance — without external consulting dependency.