What is LGPD?
The LGPD (Lei Geral de Proteção de Dados Pessoais) is Brazil’s general data protection law, enacted in September 2020. It regulates how personal data of individuals in Brazil is collected, processed, stored, and shared. LGPD is heavily inspired by GDPR and shares many of the same principles, but has important differences that Brazilian businesses and any company processing data of Brazilian residents need to understand.Who does LGPD apply to?
LGPD applies to you if:- You process personal data of individuals located in Brazil
- The data processing takes place in Brazil
- The data was collected in Brazil
- You offer goods or services to individuals in Brazil
Key principles for email
1. Legal basis for processing
Like GDPR, LGPD requires a legal basis to process personal data. For email marketing, the relevant bases are: Consent — the most straightforward basis. The recipient explicitly agrees to receive your emails. Legitimate interest — you have a genuine reason to contact the person, balanced against their privacy rights. LGPD requires a Legitimate Interest Assessment (LIA) documenting this balance. For transactional emails, the basis is typically contract execution or regular exercise of rights — the email is necessary for a service the user has with you.2. Consent requirements
LGPD consent for email marketing must be:| Requirement | What it means |
|---|---|
| Free | Not coerced or bundled with other terms |
| Informed | The recipient knows what they’re consenting to |
| Unambiguous | Clear affirmative action (not silence or pre-checked boxes) |
| Specific | For a specific purpose (“marketing emails from SendKit”) |
3. Right to information
At the time of data collection, you must inform the recipient about:- What data you’re collecting
- Why you’re collecting it (purpose)
- How long you’ll keep it
- Who you’ll share it with (including email service providers like SendKit)
- How they can exercise their rights
4. Rights of data subjects
LGPD grants recipients several rights:| Right | Description |
|---|---|
| Confirmation | Confirm whether their data is being processed |
| Access | Request a copy of their personal data |
| Correction | Request correction of inaccurate data |
| Deletion | Request deletion of unnecessary or excessive data |
| Portability | Request data in a standard format for transfer |
| Revocation | Withdraw consent at any time |
| Information | Know which third parties their data was shared with |
5. Data minimization
Only collect and process the data you actually need. For email sending, this means: Necessary: Email address, name (for personalization), consent record Probably not necessary: Phone number, physical address, date of birth (unless relevant to your product) Don’t collect extra data “just in case” — this violates the data minimization principle.LGPD vs GDPR
| Aspect | LGPD | GDPR |
|---|---|---|
| Geographic scope | Data of individuals in Brazil | Data of individuals in EU/EEA |
| Legal bases | 10 legal bases | 6 legal bases |
| DPO requirement | Required for all organizations | Required only in specific cases |
| Consent for marketing | Explicit consent required | Explicit consent required |
| Data breach notification | ”Reasonable time” (no specific deadline) | 72 hours |
| Fines | Up to 2% of revenue, max R$50 million per violation | Up to 4% of global revenue or €20M |
| Enforcement | ANPD (Autoridade Nacional de Proteção de Dados) | National DPAs in each EU country |
Notable differences
More legal bases — LGPD has 10 legal bases for processing (vs GDPR’s 6), including “protection of credit” and “regular exercise of rights.” DPO for everyone — LGPD requires every organization that processes personal data to appoint a Data Protection Officer (DPO), called “Encarregado” in Portuguese. GDPR only requires a DPO in specific cases. Vaguer breach notification — LGPD requires notification in a “reasonable time” rather than GDPR’s strict 72-hour deadline.The role of ANPD
The ANPD (Autoridade Nacional de Proteção de Dados) is Brazil’s data protection authority. It’s responsible for:- Issuing guidance on LGPD compliance
- Investigating complaints
- Imposing penalties
- Approving codes of conduct and certifications
Penalties
| Penalty type | Maximum |
|---|---|
| Warning | With a deadline to fix the issue |
| Simple fine | 2% of revenue, up to R$50 million per violation |
| Daily fine | For ongoing violations |
| Data blocking | Prohibition on using the data until the issue is resolved |
| Data deletion | Mandatory deletion of the data involved |
Checklist for compliance
- Marketing emails only go to recipients who gave explicit consent
- Consent records include what, when, how, and purpose
- Privacy policy is accessible and explains data processing practices
- Every marketing email has a working unsubscribe link
- You can process data access, correction, deletion, and portability requests
- A DPO (Encarregado) has been appointed
- Data processing agreements are in place with third-party processors (like SendKit)
- Only necessary data is collected (data minimization)
FAQ
Does LGPD apply if my company is not in Brazil?
Does LGPD apply if my company is not in Brazil?
Yes, if you process personal data of individuals in Brazil or offer goods/services to people in Brazil. The company’s location doesn’t matter — what matters is the location of the data subjects.
Can I use legitimate interest instead of consent for marketing emails?
Can I use legitimate interest instead of consent for marketing emails?
It’s possible but risky. You’d need to conduct and document a Legitimate Interest Assessment (LIA), and be prepared to justify your decision to the ANPD. Consent is the safer and more common approach for marketing emails in Brazil.
Do I need to appoint a DPO?
Do I need to appoint a DPO?
Yes. Under LGPD, all organizations that process personal data must appoint an Encarregado (DPO). This can be an internal employee or an external service. The DPO’s contact information must be publicly available.
Is double opt-in required by LGPD?
Is double opt-in required by LGPD?
Not explicitly required, but strongly recommended. Double opt-in provides strong evidence of consent and is viewed favorably by the ANPD. It also protects you from fraudulent signups.