What rights do individuals have under LGPD?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Under LGPD, people in Brazil have a set of rights over their personal data. Here's what each one means for your email program.
Right to confirmation: People can ask whether you're processing their data at all. Right to access: They can get a copy of what you hold on them. Right to correction: They can ask you to fix incomplete, inaccurate, or outdated information. These three rights mean you need to know exactly what data you have and be able to retrieve it on request.
Right to anonymization, blocking, or deletion: Data that's unnecessary, excessive, or unlawfully processed can be anonymized or removed. Right to portability: People can receive their data in a structured format and transfer it to another provider. Right to information about sharing: They can ask which third parties have received their data. Right to revoke consent: They can withdraw consent at any time, and you must stop processing based on that consent.
Rights requests must be handled through simplified procedures and responded to within reasonable timeframes. You can't charge for responding except in cases of clearly excessive or unfounded requests. If you're already handling GDPR rights requests, the processes are similar enough that extending your existing workflow to Brazilian contacts is usually straightforward.
The most operationally important right for email marketers is consent revocation: when someone revokes it, you stop sending. Check that your consent documentation includes a clear trail for each Brazilian subscriber so you can handle revocation and deletion requests accurately.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
