What is LGPD?

The LGPD (Lei Geral de Proteção de Dados Pessoais) is Brazil's comprehensive data protection law, enacted in 2020. Modeled substantially on GDPR, it regulates how organizations collect, process, store, and share personal data of individuals in Brazil. For email marketers, LGPD requires a lawful basis for processing-typically consent, and grants individuals rights over their data.

LGPD applies to any processing of personal data in Brazil, data collected in Brazil, or data used to offer goods/services to individuals in Brazil-regardless of where the processing organization is located. Like GDPR, it has extraterritorial reach: a US company with Brazilian customers must comply.

The law establishes the ANPD (Autoridade Nacional de Proteção de Dados) as the regulatory authority with enforcement powers. While LGPD shares GDPR's philosophical framework around individual rights and consent, some specifics differ-including additional legal bases beyond consent and slightly different requirements for data protection officers. LGPD extended GDPR-style protection to Latin America's largest market, making robust consent and individual rights frameworks essential for global email operations.