What is LGPD?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
If you email people in Brazil, you're operating under LGPD (Lei Geral de Proteção de Dados Pessoais), Brazil's national data protection law enacted in August 2018 and effective since September 2020. It follows the same model as GDPR: organizations need a lawful basis to process personal data, individuals have rights over their data, and the law reaches beyond Brazil's borders. For email marketers, consent is usually the relevant legal basis.
LGPD applies when: the processing happens in Brazil, the data was collected in Brazil, or the processing aims to offer goods or services to people in Brazil. It doesn't matter where you're headquartered. A US company with Brazilian subscribers must comply with LGPD for those contacts, just as it'd need to comply with GDPR for EU subscribers.
The law established ANPD (Autoridade Nacional de Proteção de Dados) as the enforcement authority. LGPD tracks closely with GDPR in philosophy, but some specifics differ: there are additional recognized legal bases beyond consent, and the data protection officer requirements aren't identical. The key requirements for email marketing are covered separately.
If you're already GDPR-compliant, LGPD compliance for email is mostly within reach. Confirm you have explicit consent documented for Brazilian subscribers, and that your process for handling individual rights requests extends to Brazilian contacts too.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
