LGPD & Data Privacy (Brazil)
This page documents the Brazil-specific aspects of how Birdie anonymizes and protects personal data under the Lei Geral de Proteção de Dados (LGPD). It complements the region-neutral Data Anonymization Process — Speech-to-Text Pipeline, which describes the end-to-end flow, the categories of PII removed, and the redaction techniques used.
Anonymization under LGPD Art. 12
LGPD Art. 12 places anonymized data outside the scope of the law: data that, by reasonable and available technical means, can no longer be associated with an individual. The LGPD distinguishes this from pseudonymized data, where the link to the individual is merely replaced by a reversible reference that can be restored using additional information — which is not sufficient to take data out of scope.
Birdie's redaction produces anonymized data, not pseudonymized data. The full technical argument — destructive replacement with a single fixed [REDACTED] label, no mapping table/token vault/key, a one-way transformation, and persistence of only the redacted text — is set out in Why the Result Is Irreversible Anonymization.
Applied to Art. 12: because no "additional information" capable of reversing the redaction is ever produced or stored, the redacted transcript cannot be re-associated with an individual by reasonable technical means. It therefore meets the LGPD's irreversibility criterion for anonymized data.
Brazilian identifiers redacted
In addition to the general PII categories (names, phone numbers, email addresses, physical addresses, credit cards, bank accounts, passwords, dates), Birdie applies dedicated pattern rules for Brazilian identifiers:
CPF
123.456.789-00, 12345678900
RG
12.345.678-9
CNH
11-digit license numbers
Bank data
Banco 001, Agência 1234, Conta 1234567-8
These patterns run as the deterministic safety net (Stage 2) described in the anonymization pipeline, after the semantic (language-model) redaction stage.
Data residency for Brazil
For clients in Brazil, in compliance with the LGPD, transcription and anonymization run in GCP region southamerica-east-1 prior to final persistence at the global index in GCP region us-central-1, Iowa.
See also:
Data Anonymization Process — Speech-to-Text Pipeline — full flow, PII categories, and redaction techniques.
PII & PHI anonymization — the two anonymization paths and the full list of PII/PHI types.
UK, GDPR & Data Privacy FAQ — international data-transfer and privacy questions.
Additional sources
Last updated