Definition
The LGPD (Lei Geral de Proteção de Dados, Law 13.709/2018) is Brazil's general data protection law, which sets the lawful bases, consent rules and data subject rights that apply to business messaging to Brazilian numbers.
The LGPD applies to personal data processing in Brazil, and a phone number on a send list is personal data. There is no single bulk SMS statute in Brazil, so a sender combines Anatel and operator rules, consumer protection and the LGPD.
Article 7 lists the lawful bases for processing, including consent and the controller's legitimate interests. Legitimate interest is balanced against the person's rights and is harder to rely on for unsolicited marketing, so most senders choose consent for promotional SMS.
Article 8 sets the consent rules. Written consent must be in a highlighted clause, the controller bears the burden of proving consent, generic authorisations are void, and people can withdraw consent through a free and facilitated procedure. In practice, keep the wording, timestamp, channel and number for every opt-in, and offer a simple STOP or SAIR reply.
The national authority, the ANPD, enforces the law. Article 52 allows administrative sanctions including a simple fine of up to 2% of the company's revenue in Brazil in its last year, capped at R$50 million per infraction. That is a ceiling, not a tariff, and outcomes depend on the case. Take legal advice on your exposure.
Frequently asked questions
Do I need consent to send marketing SMS in Brazil?
For marketing, the safe lawful basis is consent you can prove. The LGPD puts the burden of proving consent on the controller, voids generic authorisations and ties consent to specified purposes. Keep records of wording, timestamp, channel and number for every opt-in.
What are the penalties under the LGPD?
Administrative sanctions include warnings and a simple fine of up to 2% of the company's revenue in Brazil in its last financial year, capped at R$50 million per infraction. The ANPD enforces them. The fine is a ceiling, not a tariff, and depends on the case.
Can people withdraw consent under the LGPD?
Yes. The law lets the person withdraw consent at any time through a free and facilitated procedure. For SMS, honour STOP or SAIR replies at once and apply the opt-out across your lists and channels.