AI data sovereignty in Brazil: what the LGPD requires of anyone using artificial intelligence

Every time you paste a contract, a medical record, a customer spreadsheet, or a chunk of proprietary code into a foreign AI chat, you are doing something many people overlook: sending data out of Brazil. For companies handling sensitive information, that everyday gesture has concrete implications under the LGPD (Brazil's General Data Protection Law, Law No. 13,709/2018). This article explains why processing data with AI inside Brazil is the safer choice — and how to do it in practice.

The LGPD in three principles that matter for AI

The LGPD does not ban artificial intelligence — it sets rules for how personal data is processed. Three pillars are especially relevant when AI is involved:

• Lawful basis: every processing activity needs one of the legal grounds in Article 7 (consent, contract performance, legitimate interest, legal obligation, etc.). Feeding customer data into an AI API with no defined basis is a problem.
• Minimization and purpose: you should only process the data that's necessary, for the stated purpose. Sending an entire document when an excerpt would do violates minimization (Article 6).
• Data subject rights: people can request access, correction, anonymization, and deletion of their data (Article 18). Can you guarantee that if the data ended up on a foreign vendor's servers you don't control?

The hidden risk: international data transfer

When processing happens on servers outside the country, an international data transfer occurs, governed by Articles 33 to 36 of the LGPD. It is only permitted under specific conditions — such as countries with an adequate level of protection, specific contractual clauses, or the data subject's explicit consent. For sensitive data (health, biometrics, racial origin, political opinion), the bar is even higher.

In practice, when your prompts leave Brazil, you take on a set of risks:

Risk	What it means
Foreign jurisdiction	Data becomes subject to another country's laws, which can compel access by local authorities.
Transfer without basis	You may lack a clear lawful basis for the international transfer under the LGPD.
Opaque retention	You don't always know whether prompts are logged, for how long, or whether they become training data.
Audit difficulty	Fulfilling data subject requests and audits is harder when processing is a third-party black box.

It's not just data: it's continuity — the Claude Fable 5 case

In June 2026, Anthropic suspended Claude Fable 5 and Mythos 5 for all customers, complying with a US government directive. The models vanished overnight. Other Claude models, such as Opus 4.8, stayed online — but anyone who depended specifically on Fable 5 or Mythos 5 was left with no immediate alternative.

The lesson goes beyond privacy: sovereignty is not only about where data lives, but also about who controls the tool's continuity. A regulatory decision made outside Brazil can interrupt your operation. Treating that as business risk is maturity — not paranoia.

The sovereign answer: open-source on Brazilian GPUs

The option that solves both problems — privacy and continuity — is running open-source models (DeepSeek, Qwen 3, Llama 4, Mistral) on your own GPU located in Brazil. With that:

1. Data never leaves the country. No international transfer, no foreign jurisdiction over your prompts.
2. Processing is auditable. You control logging, retention, and access — making it easier to meet minimization, purpose, and data subject rights.
3. The tool can't be switched off by a third party. The model weights are yours, versioned.
4. Local latency. A GPU in Brazil means faster responses for Brazilian users and systems.

How to do it on GPUBrazil

In the Console, launch the vLLM template on a suitable GPU, and you get an OpenAI-compatible endpoint running 100% in Brazil. Billing is hourly, in reais, via Pix — no capex and no FX risk. The RTX A4000 starts from R$1.80/h; for other GPU models, see live pricing in the console.

# Self-hosted endpoint in Brazil — data never leaves the country
from openai import OpenAI

client = OpenAI(
    base_url="https://your-instance.gpubrazil.com/v1",
    api_key="your-local-key",
)

resp = client.chat.completions.create(
    model="Qwen/Qwen3-235B-A22B",
    messages=[{"role": "user", "content": "Summarize this record in anonymized form."}],
)
print(resp.choices[0].message.content)

Frequently asked questions

Does the LGPD allow sending personal data to a foreign AI API?

It can, but it constitutes an international data transfer, which the LGPD regulates in its own chapter (articles 33 to 36) and which requires a lawful basis and adequate safeguards. For sensitive data the bar is higher. Processing inside Brazil on a local GPU removes the transfer and simplifies compliance. This is not legal advice — consult your DPO or attorney.

How does self-hosting open-source models help with LGPD compliance?

By running an open-source model on your own GPU in Brazil, prompts and sensitive data never leave the country or pass through a foreign third party. You control logging, retention, and access, which makes it easier to meet principles like data minimization, purpose limitation, and data subject rights, and keeps processing auditable.

What does the Claude Fable 5 and Mythos 5 suspension have to do with data sovereignty?

It shows that depending on a foreign AI carries operational risk on top of data risk: a production model can be switched off by a government order made outside Brazil. Sovereignty is not only about where data lives, but also about control over the tool's continuity.

Conclusion

The LGPD doesn't ask you to abandon AI — it asks you to be deliberate about where and how data is processed. For sensitive information, processing inside Brazil on self-hosted open-source models is the choice that reduces transfer risk, simplifies audits, and guarantees continuity. Data sovereignty, in practice, is control.

Read next: The sovereignty lesson from the Claude Fable 5 case · Plan B when an AI model vanishes · How much it costs to run AI in Brazil in 2026