How to use AI on sensitive data without the data leaving your company.
What the law calls sensitive, what changes when that data enters an AI workflow, and the architecture that keeps a person's identifier inside your environment from start to finish.
The short answer.
What crosses the boundary is the case, not the person. The identifier is swapped for an internal key before anything leaves, the mapping between key and person stays in a table inside the client's environment, and the model's result comes back and is re-associated in there. On the outside, at no point can anyone get to who it is.
That is not a restriction that gets in the way of the project: it is what makes the project approvable. In most of the cases where AI is useful — triage, classification, prioritization, summarizing — the model does not need to know whose case it is to get it right. It needs the facts of the case.
This text is not legal advice. It describes architecture and quotes the LGPD with a link to the official source. The legal reading of your case belongs to your lawyers or your data protection officer, and the architecture has to be designed alongside that reading.
Three passages of the LGPD that decide the project.
Quoted in the original Portuguese, because paraphrasing a statute is where the error gets in — and there is no official English version. An unofficial English rendering follows each quote. Law 13.709/2018 is published in full on the Planalto site, linked at the bottom of this page.
"dado pessoal sensível: dado pessoal sobre origem racial ou étnica, convicção religiosa, opinião política, filiação a sindicato ou a organização de caráter religioso, filosófico ou político, dado referente à saúde ou à vida sexual, dado genético ou biométrico, quando vinculado a uma pessoa natural"
Unofficial translation: sensitive personal data means personal data about racial or ethnic origin, religious belief, political opinion, membership of a trade union or of a religious, philosophical or political organization, data concerning health or sex life, and genetic or biometric data, when linked to a natural person.
Look at the end of the sentence: when linked to a natural person. That link is what the boundary architecture breaks before the data leaves.
"Os dados anonimizados não serão considerados dados pessoais para os fins desta Lei, salvo quando o processo de anonimização ao qual foram submetidos for revertido, utilizando exclusivamente meios próprios, ou quando, com esforços razoáveis, puder ser revertido."
Unofficial translation: anonymized data shall not be considered personal data for the purposes of this Law, except where the anonymization process it was subjected to is reversed using the entity's own means alone, or where it can be reversed with reasonable effort.
This is the part no project reads until something goes wrong. Anonymization is not a stamp: if you can get back to the person with reasonable effort, the data is still personal.
"Os agentes de tratamento devem adotar medidas de segurança, técnicas e administrativas aptas a proteger os dados pessoais de acessos não autorizados e de situações acidentais ou ilícitas de destruição, perda, alteração, comunicação ou qualquer forma de tratamento inadequado ou ilícito."
Unofficial translation: processing agents shall adopt security measures, technical and administrative, able to protect personal data from unauthorized access and from accidental or unlawful destruction, loss, alteration, communication or any form of inadequate or unlawful processing.
The law mandates the measure and does not list which one. The project writes the list — which is why the boundary has to live in a document, not only in the code.
The boundary architecture, in five steps.
It is the same architecture Moonxi runs in healthcare, where the patient identifier never crosses the boundary of the hospital's environment. The pattern holds for any data that cannot leave.
Classify before you move anything
Separate what is personal data, what is sensitive personal data under the definition in the law, and what is neither. Without that separation written down, every decision that follows becomes an opinion.
Draw the boundary on a diagram
One line, two sides: what stays inside the client's environment and what may leave. The person's identifier stays on the inside. That diagram is the document the security team reviews, not the code.
Swap the identifier for an internal key
What crosses the boundary is the case, not the person. A mirror table inside the client's environment holds the mapping between the key and the real identifier, and that table never leaves.
Apply permissions at retrieval, not in the prompt
Who can see what is filtered before any passage reaches the model. Asking the model not to reveal something is access control based on good will.
Log the access and test the way back
Who queried, when, about which case. Then test the reverse: holding the result and without the mirror table, can you get to the person? If you can, the boundary does not exist.
The cloud does not transfer responsibility. It divides it.
The AWS shared responsibility model is explicit, and the half that tends to catch companies by surprise is the second one.
Security OF the cloud
Protecting the infrastructure that runs the services: hardware, software, networking and the physical facilities.
Security IN the cloud
Managing your own data, including encryption options, classifying your assets, and using identity and access tools to apply the right permissions.
Translated into the project: no cloud provider classifies your data, decides who can see what, or decides what may leave your environment. Those three decisions stay yours, and they are exactly what this guide is about.
Questions about sensitive data and AI.
What does the LGPD call sensitive personal data?
Article 5, II of Law 13.709/2018 defines sensitive personal data as personal data about racial or ethnic origin, religious belief, political opinion, membership of a trade union or of a religious, philosophical or political organization, data concerning health or sex life, and genetic or biometric data, when linked to a natural person. (Unofficial translation; the binding text is Portuguese.)
Is anonymized data still personal data?
Article 12 says anonymized data is not considered personal data for the purposes of the law, with one large caveat: unless the anonymization process is reversed using the entity’s own means alone, or can be reversed with reasonable effort. In other words, anonymization is not a button — it is a property that has to keep holding afterwards.
Can I use AI without the data leaving my company?
You can, and it is the standard architecture when the data is sensitive. What crosses the boundary is the case without the person: the identifier is swapped for an internal key, the mapping stays in a table inside your environment, and the result comes back and is re-associated in there.
Who is responsible for security when I use the cloud?
It is shared. AWS states that it is responsible for protecting the infrastructure that runs its services — hardware, software, networking and facilities. The customer is responsible for security in the cloud: managing their data, including encryption options, classifying their assets, and using identity and access tools to apply the right permissions.
What does the law require in terms of security?
Article 46 requires processing agents to adopt security measures, technical and administrative, able to protect personal data from unauthorized access and from accidental or unlawful destruction, loss, alteration, communication or any inadequate or unlawful processing. The law does not list the measures: the project writes that list.
Is this legal advice?
No. This guide describes architecture and quotes the text of the law with a link to the official source. The legal reading of your case belongs to your lawyers or your data protection officer, and the architecture has to be designed alongside that reading, not after it.
Is your AI project stuck with legal?
Most of the time what is missing is not permission: it is a boundary diagram somebody can actually review. The diagnostic delivers that diagram along with the plan and the quote.
Sources
The three statute passages were copied from the official text on the Planalto site, and the shared responsibility model from the AWS page. Both were opened on August 9, 2026. The English renderings of the statute are unofficial and are marked as such.