LGPD AI Agent for Customer Service: A Practical Guide to Protecting Customer Data

If your company in Brazil handles customer service and bookings over WhatsApp, adding an AI agent to answer messages is a natural next step. What many teams forget is that the LGPD AI agent customer service question starts with the very first message. The good news: the precautions are few, and they fit into your routine without much hassle.

This guide is written for small business owners: no legalese, a checklist in order, and message templates you can copy. It does not replace legal advice, which matters especially for clinics and medical offices. (LGPD is Brazil's General Data Protection Law, comparable in spirit to the GDPR.)

Why the LGPD applies to your AI customer service agent (even in a small company)

The LGPD (Law 13.709/2018) applies to every company that uses chatbots to collect, store or process personal data, from large corporations to small and mid-sized businesses. It took effect in August 2020. There is no such thing as too small to be covered.

What data a customer service agent collects without you noticing

On WhatsApp, the agent already receives the customer's phone number in the first message, before the conversation really begins. If it looks up your CRM, it also starts processing name, email and purchase history, which are personal data too.

In a single conversation, an agent can collect name, phone number, CPF (Brazil's individual taxpayer ID), email and address. In clinics, it may also handle sensitive data, such as diagnoses.

And it's not only what the customer types. IP address, identification cookies, geolocation and device identifiers also count as personal data when they can lead back to a person.

Brazil's data protection authority (ANPD) is already watching AI

In December 2025, ANPD Resolution CD/ANPD No. 30 created the Priority Topics Map for 2026-2027. Enforcement will have four focus areas, and two matter to anyone serving customers: data subject rights, and artificial intelligence with emerging technologies.

Under the AI focus, the ANPD will assess transparency, that is, whether the data subject knows they are talking to an AI.

In February 2026, Law 15.352 turned the ANPD into a regulatory agency. Data subject rights (art. 18) and the review of automated decisions (art. 20) remain in force as before. In other words, the rules for businesses that serve customers haven't changed, and following them is much simpler than it looks.

Legal basis: not everything requires consent

A common mistake is assuming everything in customer service requires consent. It doesn't work that way. The legal basis depends on the purpose, and separating customer service from marketing clears up most of the confusion.

Customer service and scheduling

Work with your legal counsel to define the appropriate legal basis for each customer service and scheduling purpose, and keep service separate from marketing (for campaigns, obtain specific consent and record it).

Marketing and campaigns

For campaigns, the path changes. Ask for specific consent, record when and how it was given, and offer a simple way to opt out. A few practices help:

• Keep data used for customer service separate from data used for marketing.
• Don't reuse old contact lists without checking where they came from.
• Keep a record of consent, with date and channel.

These are suggested practices for using AI in customer service. Health data follows stricter rules, and the right legal basis depends on the case. In those situations, talk to a lawyer.

What the agent should and shouldn't ask when booking

The principle is simple: cut the unnecessary questions. The less data the agent collects, the less you have to protect. To book an appointment, name, contact, service, date and time are usually enough.

Clinics and medical offices: be careful with symptoms and reason for the visit

Symptoms and diagnoses are sensitive data. Don't let the agent ask for them by text. Leave that for the appointment itself or for a human team member.

Salons and service businesses: only what is necessary

Here is the difference between a lean script and one with too many questions, using a salon as the example:

Lean: "Which service would you like? What day and time do you prefer? Whose name should I confirm it under?"

Too many questions: "What's your CPF? Full date of birth? Address? Any health conditions? Which card will you use?"

The second script asks for data the booking doesn't need. Every extra piece of data is extra risk, with no benefit to the customer.

CPF and payment data

Ask for the CPF only when there's a real reason, such as health insurance or an invoice. Collect only what the request needs and avoid unnecessary financial details in chat.

LGPD AI agent customer service checklist: launch safely

These are quick steps that fit into day-to-day customer service. Follow them in order.

Before turning the agent on

• Review what the agent will have access to. Connecting entire knowledge sources, such as a SharePoint site, without reviewing the content is a common path to problems.
• If you have a data protection officer (known in Brazil as the encarregado or DPO), involve them from the design of the use case.
• Assign one person to handle data subject requests.

In the first message

• Say that the service is automated.
• State that the conversation is processed and stored.
• Include a link to your privacy policy.

A customer who chats with an agent without knowing it is an automated system, or that the conversation is stored, hasn't received the basic information the LGPD requires.

During the conversation

• Clearly offer the option to talk to a human.
• Collect only what the request needs.

After the conversation

• Decide how long to keep the history and when to delete it.
• Minimize exposure of sensitive identifiers in your logs.

Want an assistant that answers and books on its own? Create yours in minutes

Ready-to-use message templates

Adjust the tone to your brand, but keep the essential information.

Welcome message with AI notice and privacy link

Hi! I'm the virtual assistant for [company]. This service is automated and the conversation is recorded so we can take care of your request. See how we handle your data: [link]. Want to talk to a person? Type AGENT.

Reply to a data deletion request

We received your request to delete your data. We'll forward it to the person responsible at [company], who will get back to you through [channel]. If you prefer, you can also use this form: [link]. Can I help with anything else?

Article 19 of the LGPD sets deadlines for responding to the data subject, so agree internally on who responds and how fast. The agent itself can be the first line for these requests: it collects the initial information, points people to the right form and answers frequent questions, 24 hours a day.

Handoff to a human agent

Got it, I'll bring in a member of our team. They'll take over this conversation within [time]. In the meantime, you don't need to repeat what you've already told me.

The AI agent vendor and the AI provider: who is responsible for what

When the customer can't see what happens behind the agent, it's easy to forget that more parties are involved in processing the data.

Controller and processor in plain language

Define in your contract who acts as controller and who acts as processor in each data flow, and document that allocation of responsibilities. The exact split depends on the contract and the case, so it's worth consulting a lawyer.

What to require in the contract

AI agents raise two points that the LGPD treats carefully: automated decisions and the transfer of data to third parties, such as the LLM providers that process the messages. So ask your vendor:

• Where is the data stored?
• For how long?
• Are conversations used to train models?
• What security measures are in place?
• How will you notify me in case of an incident?

Training on conversations and international transfer

The ANPD already has proceedings on the use of personal data to train generative AI systems. Ask the vendor whether data is transferred internationally (for example, processed outside Brazil) and get the answer in writing before you sign.

Automated decisions, incidents and fines: what can go wrong

None of this should scare you, but it's better to know in advance where the risks are.

The right to review automated decisions

Article 20 gives the data subject the right to request a review of decisions made solely through automated processing that affect their interests. So keep a human in the loop for decisions that matter, such as refusing an appointment or a service. The agent organizes and replies; the decision that carries weight stays with a person.

Data breaches: a 3 business day deadline

Relevant security incidents must be reported to the ANPD and to affected data subjects within 3 business days. Have your responsible person's contact details at hand before you need them.

Penalties and the regime for small businesses

Administrative penalties began to apply on August 1, 2021. The LGPD provides for nine penalties, from a warning to a ban on data processing. The simple fine can reach 2% of revenue in Brazil, capped at R$ 50 million per infraction (art. 52, II).

For small companies, the ANPD has Resolution CD/ANPD No. 2/2022, which covers small-scale processing agents, and it has already published an information security guide for this audience. Take the time to read it and see how it applies to your business.

One warning: no tool guarantees "total compliance" or "100% security." Be wary of anyone who promises that.

Conclusion: automated customer service and the LGPD go hand in hand

With an AI notice in the first message, lean questions, a channel for data subject rights, the option to talk to a human and retention rules, an AI agent fits into customer service and scheduling without complications. Most of the work is a process decision, not a technology one.

In sensitive cases, such as healthcare, get legal advice before putting the agent live. When you're ready to get started with AI agents for customer service, take the first step today.

Talk to our team about AI agents