What is the scope of LGPD (Brazil)?

LGPD applies to any processing of personal data in three scenarios: the processing is carried out in Brazil (regardless of where the processor is located), the processing activity aims to offer goods/services to individuals in Brazil, or the personal data was collected in Brazil. Like GDPR, the law has extraterritorial reach.

"Personal data" under LGPD is broadly defined: any information relating to an identified or identifiable natural person. Email addresses are clearly personal data. "Processing" encompasses virtually any operation performed on personal data: collection, storage, use, sharing, modification, deletion. Sending marketing emails involves multiple processing activities.

LGPD covers both data controllers and processors, creating obligations throughout the data processing chain. Some processing is exempt: purely personal activities, journalistic/artistic purposes, academic research, public security, and certain historical/scientific uses. Commercial email marketing doesn't qualify for exemptions. Brazilian scope is intentionally broad. If uyou have Brazilian customers or subscribers, assume LGPD applies and implement appropriate protections.