Who does LGPD apply to?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Like GDPR, LGPD applies based on where the people are, not where you're based. If you're processing personal data of individuals in Brazil, LGPD applies to you, regardless of whether your company is in Brazil, the US, or anywhere else.
Specifically, LGPD covers any processing when: the processing happens in Brazil, the data was collected in Brazil, the processing is aimed at offering goods or services to people in Brazil, or the processing involves data about people located in Brazil. If your email list has Brazilian subscribers, you're in scope.
The law covers both data controllers (you, deciding what data to collect and why) and data processors (your ESP, processing data on your behalf). Both parties have obligations under LGPD.
Certain activities are exempt: personal use, journalism and academic research, and public security purposes. Commercial email marketing to Brazilian individuals doesn't qualify for any of those exemptions.
The practical test: if your list has Brazilian subscribers and you can't guarantee you excluded them, LGPD applies. It's similar enough to GDPR in structure that if you're already GDPR-compliant, you're most of the way there. The main gaps to check are the specific consent and data rights requirements that differ slightly from GDPR's formulation.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
