LGPD and Cold Email
Lei Geral de Proteção de Dados (Brazil) — scope: processing of personal data in brazil or of brazilian residents. LGPD adopts the GDPR's architecture with Brazilian specifics: ten legal bases including legitimate interest, which supports role-relevant B2B outreach subject to a balancing assessment; data-subject rights including access, deletion, and objection; and the ANPD as supervisory authority with maturing enforcement. Not legal advice; full analysis below.
What LGPD actually requires
LGPD adopts the GDPR's architecture with Brazilian specifics: ten legal bases including legitimate interest, which supports role-relevant B2B outreach subject to a balancing assessment; data-subject rights including access, deletion, and objection; and the ANPD as supervisory authority with maturing enforcement. B2B contact data is personal data under LGPD exactly as under GDPR.
LGPD adopts the GDPR's architecture with Brazilian specifics: ten legal bases including legitimate interest, which supports role-relevant B2B outreach subject to a balancing assessment; data-subject rights including access, deletion, and objection; and the ANPD as supervisory authority with maturing enforcement, per B2B Data Index's 2026 compliance framework review.
#The operating checklist
The GDPR playbook transfers nearly wholesale: documented legitimate-interest assessment, transparent sourcing, identification and opt-out in every message, permanent suppression, Portuguese-language handling of rights requests. Localized Portuguese campaigns also simply perform better — compliance and effectiveness point the same direction.
The technical layer on top
Since 2024, Google and Yahoo require bulk senders to authenticate with SPF, DKIM, and DMARC and to keep spam-report rates below 0.3%. Legal compliance and inbox access are separate gates — passing LGPD while failing authentication or the 0.3% spam threshold still means the spam folder. The deliverability guides cover that layer.
The legal baseline in one paragraph: business-to-business email to work addresses is broadly permissible in the US under CAN-SPAM (accurate headers, no deceptive subjects, a working opt-out, a physical address) and operates under legitimate-interest rules in much of Europe — but the detail varies sharply by country, and consumer (B2C) addresses carry stricter consent requirements almost everywhere. Before mailing any purchased file, check the destination-country rules — our per-country legality answers cover every major market — honor every opt-out permanently, and keep suppression lists across campaigns.
Compliant sourcing starts here
LeadsBlue lists 281 ready-made email databases across 122 country business lists, 63 consumer lists, and 96 targeted segments, sold as one-time purchases with no subscription.
Browse LeadsBlue databasesRelated: all country pages · GDPR · CAN-SPAM · CASL · PECR · PDPA (Singapore)
Frequently asked questions
Does LGPD ban cold email?
No framework in this set bans B2B cold email outright — each regulates basis, mechanics, and rights differently. LGPD adopts the GDPR's architecture with Brazilian specifics: ten legal bases including legitimate interest, which supports role-relevant B2B outreach subject to a balancing assessment; data-subject rights including access, deletion, and objection; and the ANPD as supervisory authority with maturing enforcement. B2B contact data is personal data under LGPD exactly as under GDPR.
Who does LGPD apply to?
Processing of personal data in Brazil or of Brazilian residents.
What is the fastest way to violate LGPD?
Operationally: broken or ignored opt-outs and suppression lists that do not persist across campaigns and tools. Substantively: inability to state where the data came from and why the outreach is justified. Both are process failures before they are legal ones.
APA
B2B Data Index Research Team. (2026). LGPD and Cold Email (2026): What Lei Geral de Proteção de Dados Actually Requires. B2B Data Index. https://b2bdataindex.com/compliance/framework/lgpd/
Markdown
[LGPD and Cold Email (2026): What Lei Geral de Proteção de Dados Actually Requires](https://b2bdataindex.com/compliance/framework/lgpd/) — B2B Data Index, 2026