Before sending data to AI, classify what can leave the company
Technically, a public presentation, a contract, a financial spreadsheet and a customer database can all go through the same AI interface. That doesn't mean all of them can be sent or handled under the same rules. Brazil's General Data Protection Law (LGPD) distinguishes personal data from sensitive personal data and sets out principles such as purpose, necessity, security and accountability. The application's context also needs to enter the operational assessment.
Using AI, by itself, doesn't define whether a piece of information can be sent. The company needs to know what data will be entered, for what purpose, in which solution and with what consequence if there is exposure, error or misuse.
Classifying turns a generic ban into an applicable rule
An internal classification organizes levels of confidentiality and access, such as public, internal and confidential information. The nature of personal data and the criticality of the process are complementary criteria, not categories that replace this classification. The names of the categories matter less than the team's ability to recognize the level of care required.
In practice, tasks without internal data can use authorized tools more freely. Confidential documents may require an approved solution, specific configuration or additional review. Sensitive personal data requires attention to the applicable LGPD rules. For confidential information or critical processes, the company should escalate the assessment when there is impact on people, finances, operational continuity, relevant decisions or system access.
The decision includes the solution and the owner
Classifying the data isn't enough. The company also needs to understand how the vendor handles information, what controls exist, which configurations can be applied and which responsibilities remain with the organization. Even a locally run solution can be connected to databases, integrations or external services.
A minimum criterion combines classification and the solution's capability: public data can follow an authorized flow; internal data requires an approved tool and restricted access; sensitive personal data, confidential information or critical processes may require additional validation or blocking according to internal policy and risk assessment, considering the purpose, usage rights, the tool's controls and the applicable legal requirements. Classification doesn't replace these checks. Before authorizing, record a defined purpose, internal authorization, an approved tool, compatible technical and contractual controls and, where applicable, a privacy and security assessment. Consider critical any process that affects people, finances, operational continuity, relevant decisions or system access; the greater that impact, the stricter the validation should be. Consider relevant any application that handles personal data or confidential data, integrates systems or can produce material impact on the process. Each relevant application should have permitted data, an owner, a usage limit and review triggers, such as a change of vendor, integration, purpose or type of data handled. The goal is to record, guide and supervise authorized uses.
The first test is mapping current use
Start with a simple inventory: which areas use AI, for what tasks, with what information, in which solutions and under whose responsibility? Then pick a low-risk use. With the owner designated for the application and the internal privacy, security or governance channel defined by the company, assess whether the team can recognize what can be shared and when it needs to ask for authorization.
This survey can reveal undocumented uses and show where review should be stricter. Record each use, assign it a decision, allow, condition or block, and name an owner. The more sensitive the data or the greater the impact of an error, the more thorough the assessment should be before scaling.
This content is for informational purposes and does not replace a legal, privacy or security assessment for specific applications.
Sources
Presidência da República, 14 Aug 2018. https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/L13709compilado.htm
Autoridade Nacional de Proteção de Dados (ANPD), 2024. https://www.gov.br/anpd/pt-br/centrais-de-conteudo/documentos-tecnicos-orientativos/radar_tecnologico_ia_generativa_anpd.pdf/@@display-file/file
Autoridade Nacional de Proteção de Dados (ANPD). https://www.gov.br/anpd/pt-br/centrais-de-conteudo/materiais-educativos-e-publicacoes/guia-orientativo-sobre-seguranca-da-informacao-para-agentes-de-tratamento-de-pequeno-porte
Autoridade Nacional de Proteção de Dados (ANPD). https://www.gov.br/anpd/pt-br/centrais-de-conteudo/modelo_de_ropa_para_atpp.pdf/@@display-file/file