DPA Generator for BR

BR-specific obligations covered

The output is anchored on the regulations that apply to AI deployments in BR. The top frameworks cited:

• Lei Geral de Proteção de Dados — LGPD (Law 13,709/2018)national_law · In force

  Data controllers must establish a lawful basis for all personal data processing, honour data subject rights including the right to request review of decisions made exclusively by automated processing, appoint a DPO, and report data breaches to the ANPD.

• Brazilian Artificial Intelligence Bill (PL 2338/2023 — Senate)proposed_legislation · Proposed

  Providers and operators of high-risk AI systems must conduct impact assessments, ensure transparency and explainability of consequential AI decisions, implement human oversight mechanisms, and register high-risk AI systems with the designated national authority.

• Marco Civil da Internet — Law 12,965/2014national_law · In force

  Internet application providers must preserve connection and application access logs for court-ordered disclosure, refrain from supplying personal data to third parties without consent, and comply with Brazilian judicial orders for user data within specified timeframes.

• BACEN Resolution 4,658/2018 — Cybersecurity Policy for Financial Institutionsregulatory_resolution · In force

  Financial institutions using AI must establish board-approved cybersecurity policies, conduct comprehensive risk assessments of AI suppliers and cloud providers, maintain relevant contracts with security obligations, and report significant cybersecurity incidents to BACEN.

How the DPA Generator approaches this

You describe your organisation, the AI vendor (Processor), the AI service being procured, and the categories of personal data the service will process. The tool maps your jurisdiction + industry + risk appetite into a structured, schedule-based DPA ready to redline with your legal team.

The DPA follows the format working contract lawyers recognise — main clauses for the contractual body, schedules for the GDPR Art. 28(3) particulars (subject matter / duration / nature / purpose / data categories / data subject categories), schedules for the operational details (TOMs, sub-processors, transfer mechanism), and annexes for the AI-specific protections + negotiation positions + consolidated review-required notes. Risk-appetite-driven defaults (security standard, audit notice, breach window, liability cap, model-update notice) are internally consistent across clauses, schedules, and the negotiation checklist. This is an AI-assisted drafting aid intended to accelerate review by qualified data-protection counsel.

What you get

• ✓ Schedule-based GDPR Art.28(3) format that working contract lawyers recognise — main clauses + 4 schedules + 3 annexes + signature blocks, not a flat clause-list.
• ✓ Sub-Processor schedule pre-populated with typical sub-processors for the named vendor (e.g. Microsoft Azure for OpenAI services), with explicit ⚠️ verify callout — saves the customer and counsel hours of inferring the chain.
• ✓ Inline ⚖️ qualified-legal-review callouts at known risk points (security standard, breach notification window, audit cost allocation, IP ownership, training-data restrictions, AI-error liability cap), consolidated into Annex C with the specific counsel competence required for each.
• ✓ Risk-appetite-driven defaults are internally consistent — security standard, audit notice, breach window, liability cap, and model-update notice all reference the same risk-appetite-driven values across clauses, schedules, and the negotiation checklist.

Ready to generate?

$39 · one-time — answer a 6-question intake (including jurisdiction = BR), and download your tailored document immediately.

Also available framed for your sector → see industry-specific pages