By Nicolas Avila · August 13, 2026

How can you use AI in customer service without violating Brazil’s LGPD?

Photo: Avila Ops Tecnologia

Using AI in customer service is allowed, but personal data processing remains subject to the LGPD. In practice, a business needs four things: notice that service is automated, a defined legal basis and purpose for collected data, collection limited to what is necessary, and human review when decisions affect customers. You also need to know what the tool provider does with conversations, including whether it uses them to train models.

What changes when AI enters the process

The LGPD does not treat AI as a separate category: it regulates personal data processing, and virtual assistants process data constantly, including names, phone numbers, addresses, purchase histories and sometimes sensitive data such as health information. The difference is greater volume, automatic recording and data passing through third parties: the AI provider, WhatsApp platform and CRM. This expands responsibility rather than creating an exception.

• Map the data customer service collects today
• Identify whether sensitive data is involved: health, biometrics, financial information
• List the providers through which the data passes
• Define how long each data type stays stored

Transparency: customers need to know

Hiding automated service offers no advantage and creates risk. Good practice is simple: say at the start that the customer is speaking with a virtual assistant, explain they can request a person at any time, and provide an accessible privacy policy explaining collection and purposes in language customers understand.

• Automated service notice in the first message
• An explicit option to speak with a human representative
• A linked, updated privacy policy
• A channel for data subjects to request access, correction or deletion
• A named person responsible for answering these requests

Legal basis and purpose

Every collected data item needs a purpose and legal basis. Handling customers’ own requests generally rests on contract performance or preliminary procedures. Using that contact later for marketing is another purpose and usually requires specific consent. Mixing the two is the most common mistake and the easiest to avoid.

• Separate service data from marketing data
• Request specific consent for campaigns
• Record when and how consent was given
• Offer simple unsubscribing in every communication
• Do not reuse old lists without checking their origin

Minimization and retention

Virtual assistants tend to collect more than necessary because asking is cheap. Every additional field adds risk in a breach. Collect what resolves the interaction, avoid requesting documents without a reason and set deletion deadlines. Service conversations need not be stored forever.

• Review agent questions and remove unnecessary ones
• Do not request CPF, identification documents or health data without a clear purpose
• Set retention periods by data type
• Restrict team access to complete histories
• Use individual access rather than shared accounts

Automated decisions require human review

The LGPD gives data subjects the right to request review of decisions based solely on automated processing when they affect their interests. Small businesses encounter this in concrete situations: refusing quotes, denying deadlines, classifying customers as delinquent, prioritizing or discarding leads. At those points, agents can suggest; a person decides.

• List the decisions the system makes alone today
• Define which require human approval
• Record the criteria used so you can explain them later
• Provide a clear path for customers to challenge decisions

The provider is also your responsibility

Hiring a tool does not transfer responsibility: the business answers to customers. Before activating any AI solution, check where data stays, whether it trains models, who has access, what happens when the contract ends and whether there is a data processing agreement. Oversight of AI use and personal data has become a protection authority priority; improvising here is costly.

• A supplier contract or terms covering data processing
• Check whether conversations train models
• Confirm where data is stored and for how long
• Ensure export and deletion when the contract ends
• Prefer providers documenting security and compliance

How Avila Ops implements it

Avila Ops configures automation and AI agents with compliance basics already addressed: automated service notices, a published privacy policy, minimum collection, history access control, human handoff rules and records of decisions. This does not replace legal guidance, but it prevents businesses from having to dismantle operations later to comply.