LGPD (Brazil)

Brazilian privacy law protects a person whose data is processed and names an officer who answers for it. An assistant that handles customer records falls inside that regime. This starter covers the traffic controls, and advice on legal reporting stays with counsel.

The law reads like a familiar privacy regime and then differs in detail. Legal bases are broader, the officer is a named role, and incident communication follows national resolution guidance. A privacy lead in Brazil needs controls that survive that specificity.

On the request path, national identifier numbers are masked. Prompts about rights requests, sensitive personal information or third party sharing are refused. Injection screening and a verified identity check run before either of those, so a prompt cannot argue its way past authentication.

Nothing written by the model reaches a requester in this configuration. Each response is escalated to a person and recorded, which protects a rights letter that is a legal document rather than a model output. Deletion and export work needs the same staffing as an ordinary question does.

Answers must reach 0.85 combined, 0.78 relevance and 0.80 accuracy, with at least 120 characters across two sentences. Grounding is measured and flagged, and it blocks only when you configure that.

Officer appointment, legal basis records and incident notices to the authority stay with your program. The California privacy starter follows the same shape for a different regulator and a different rights vocabulary.