LGPD in Marketing and CRM: A Practical Guide for Small Businesses
If your company stores customer names, emails and phone numbers — in spreadsheets, on WhatsApp or in a CRM — it is already processing personal data. That means Brazil's General Data Protection Law (LGPD, Law 13,709/2018), similar in spirit to Europe's GDPR, applies to your business, no matter its size.
The good news: complying with the LGPD does not have to be complicated or expensive. Done well, it organizes your contact base, improves campaign quality and builds trust with the people who buy from you. In this guide, we explain the essentials for small and medium-sized businesses operating in or selling to Brazil.
What the LGPD changes in everyday marketing
The law requires every use of personal data to have a clear purpose and a legal basis, meaning a justification established by law. In marketing, this affects lead capture forms, email lists, WhatsApp messaging, ad pixels and the way your CRM stores each customer's history.
The legal bases most used by SMBs
Consent: the person authorizes the use freely, with information and for a specific purpose (for example, an unticked opt-in box on a form).
Contract performance: data needed to deliver what the customer bought.
Legitimate interest: can support communications with current customers, as long as it is balanced against the person's rights and offers a simple opt-out.
Legal obligation: data required by law, such as invoice records.
A 6-step compliance checklist
Map your data: list where each piece of customer information is collected and stored (website, spreadsheets, CRM, WhatsApp, social media).
Collect only what you need: if you do not use a birth date, do not ask for it.
Update forms and your privacy policy with clear language about purpose and retention period.
Make unsubscribing easy in emails and messages, and honor requests quickly.
Control access: set permissions in your CRM and avoid circulating databases in loose spreadsheets.
Appoint someone responsible for handling data subject requests and security incidents.
Common mistakes that put your company at risk
Buying ready-made email or phone lists for mass campaigns.
Using contacts collected for one purpose (such as a quote) for a completely different one without informing the person.
Keeping data indefinitely, with no deletion criteria.
Sharing databases with agencies and vendors without a contract defining responsibilities.
In case of non-compliance, Brazil's National Data Protection Authority (ANPD) can issue warnings and fines of up to 2% of revenue, capped at BRL 50 million per violation, besides damaging your brand's reputation.
Frequently asked questions about LGPD and marketing
Do small businesses have to comply with the LGPD?
Yes. The law applies to any organization that processes personal data, from sole proprietors to large corporations. Some rules are simplified for small-scale processors, but the duty to protect data remains.
Can I send WhatsApp messages to my customers?
Yes, as long as there is an appropriate legal basis, the contact relates to the purpose you disclosed, and there is a clear way to stop receiving messages.
Where should I start?
Start by mapping your data and reviewing your website and CRM forms. These two steps already remove most of the risk.
How METADAX can help
At METADAX, data governance, LGPD compliance and information security are the foundation of every project, from CRM setup to communication automations. If you want to organize your contact base securely and turn data into growth, request a free initial diagnostic and talk to a specialist.
This content is informational and does not replace specialized legal advice.
Comments