Who does LGPD apply to?

LGPD applies to any organization processing personal data when: the processing occurs in Brazil, the data was collected in Brazil, the processing aims to offer goods/services to individuals in Brazil, or the processing involves data about individuals located in Brazil. Geographic location of the organization is irrelevant-a European company with Brazilian customers must comply.

The law covers both data controllers (organizations determining processing purposes) and data processors (organizations processing on behalf of controllers). If you're a US company using a Brazilian ESP to email Brazilian subscribers, LGPD obligations apply to all parties in the processing chain.

Certain processing activities are exempt: processing by natural persons for purely personal purposes, processing exclusively for journalistic/artistic/academic purposes, and processing for public security/national defense purposes. However, commercial email marketing to Brazilian individuals doesn't qualify for exemptions. If you have Brazilian subscribers, and global email lists typically do-assume LGPD applies and implement appropriate consent mechanisms.