Brazil market-entry GTM stack guide

In Brazil, an identifiable employee's business contact details can be personal data under LGPD Article 5. A corporate target is not a general exemption for its employees or an individual business owner. For email, Articles 7 and 10 allow legitimate interest only where the concrete purpose, necessity and balance support it. ANPD's guide requires attention to reasonable expectations and safeguards and excludes sensitive data from this basis. Its promotional-email example concerns an existing academic community, not an unrestricted purchased-list exception. Our assessment is to require a documented assessment, sender identity, accessible privacy information and a working suppression path before enrollment.[1][2]

Separate live calls from recordings, dialer automation and SMS. Anatel's current 0303 guidance says the prefix became optional under Acórdão 201/2025. It separately requires call authentication for subscribers originating more than 500,000 calls during a monthly observation period, including uncompleted calls and numbers across headquarters and branches sharing the subscriber. Its description of Não Me Perturbe concerns telecom services and specified payroll-loan and payroll-card offers, not a universal SaaS suppression registry. Our assessment is to have the carrier document the applicable numbering, authentication and abuse controls rather than reuse older mandatory-0303 advice.[3]

State rules remain a separate gate. São Paulo's consolidated Law 17.832, Articles 127 to 129, covers sales calls made by employees, contractors or recordings, and includes SMS and messages through apps associated with the phone line. Article 128 prohibits calls to registered users from the thirtieth day after registration. Do not assume a live agent or a work-related mobile number bypasses that consumer-protection regime. Our assessment is to classify the recipient and state, check the applicable registry and exceptions with counsel, and block unreviewed automated calling and SMS. São Paulo is a documented example, not clearance for all other states.[4]

LinkedIn is not a legal workaround. LGPD Article 7 preserves purpose, good faith, principles and rights when data is publicly accessible or made manifestly public. LinkedIn's agreement separately prohibits scraping profiles and using bots or unauthorized automation to send messages. Our assessment is individual, relevant messages through permitted product workflows, with refusals recorded in the CRM. A connection acceptance is not a consent record for an email or phone campaign.[1][5]

LGPD Article 3 can apply regardless of the seller's headquarters or data location when its territorial conditions are met. Articles 37 and 39 require processing records and operator compliance with controller instructions. Classify an enrichment provider's actual role rather than assuming every vendor is only an operator. Article 18 provides access, correction and other rights; its objection rule for processing without consent concerns noncompliance with LGPD. It is not identical to GDPR's unconditional direct-marketing objection. Our assessment is to honor marketing refusals across every tool and prevent enrichment from reintroducing suppressed contacts.[1]

ANPD's transfer guidance describes Resolution 19/2024 mechanisms, including adequacy and unmodified Brazilian standard clauses. It now lists the EU as adequate under Resolution 32/2026. Other destinations require their own applicable mechanism; EU standard clauses are not automatically Brazilian-equivalent clauses. The European Commission separately lists Brazil as adequate for EU transfers. These mechanisms do not establish a blanket Brazilian-hosting requirement or permission to send data to every vendor subprocessor. Our assessment is to map CRM hosting, remote access, enrichment and onward destinations before choosing the mechanism for each flow.[6][7]

An EU-established exporter retains GDPR duties where Article 3 applies. Brazil's adequacy addresses the transfer safeguard, not Articles 6, 13 or 14, 21 and 28. Retain a processing basis, applicable notices, processor terms and direct-marketing suppression. For indirectly obtained data, Article 14 generally requires information within one month, earlier at first communication or disclosure where applicable, subject to its exceptions. Article 21 requires direct marketing to stop after objection. Our assessment is to store provenance, notice delivery and channel decisions separately from the international-transfer field.[8][7]

Apollo documents country and city filters for a person's location and a separate employer-headquarters filter. Its People API Search does not return email addresses or phone numbers; enrichment is separate. A Brazil-headquartered company filter therefore cannot stand in for Brazilian decision-makers at multinational subsidiaries. The checked documentation does not establish independently audited Brazil-specific recall, mobile accuracy or email fill rates. Our assessment is to compare vendors against a fixed account sample before purchasing volume, not rank them from global database totals.[9]

Our assessment is to sample Brazilian subsidiaries and domestic firms separately, including accounts outside São Paulo and both Portuguese and English role titles. Score correct employer entity, current role, country, available lawful contact channel, duplicate rate and verification date. Count missing records in the denominator. Send only the approved cohort to the CRM, and keep vendor provenance through any enrichment workflow. A geography filter proves query support, not market coverage or permission to contact.[9]

Our assessment is to assign a Brazilian Portuguese-speaking owner before launching campaigns, not after the first qualified reply. Review discovery questions, privacy notices, opt-outs, security answers and billing explanations together. Test that a prospect can move from the first message to a demo, legal review and invoice query without an unexplained switch to English. Keep the account's preferred language and actual time zone explicit rather than treating Brazil as one scheduling zone.

Our assessment is to make the sales-to-Finance handoff carry the contracting legal entity, buyer entity, billing contact, requested currency and payment rail, plus any promised tax treatment. Do not ask SDRs to improvise whether a foreign commercial invoice satisfies procurement. Require the account owner to confirm those requirements before a proposal, and route exceptions to Finance. Require the AE to obtain a named CS owner's acceptance of Portuguese support coverage, staffed hours and agreed onboarding milestones before signature. Measure Portuguese reply handling and proposal-to-payment completion separately so weak follow-through is not misdiagnosed as poor contact coverage.

Stripe documents Pix for Brazilian customers in BRL with eligible merchants in Brazil and multiple foreign countries, including several EU countries. Its current documentation distinguishes domestic one-time Pix from eligible cross-border Pix Automático recurring payments and imposes transaction limits. Boleto documentation instead lists BR merchant location and domestic coverage. A voucher is not immediate payment confirmation. Our assessment is to qualify the seller account, recurring-payment capability, limits and settlement currency before promising either rail, and reconcile confirmed payment separately from invoice issuance.[10][11]

Brazilian tax and invoicing requirements depend on the transaction and entity. Complementary Law 116 makes listed services from abroad subject to ISS and assigns responsibility to the recipient or intermediary in Article 6, paragraph 2, I. A foreign SaaS seller should not read the law's Brazilian service-export exclusion as an exemption for its sale into Brazil. Our assessment is a Finance-approved imported-service and withholding analysis, including any other applicable taxes, rather than a universal tax percentage or an assertion that the processor settles every tax obligation.[12]

The national NFS-e FAQ distinguishes municipal integration, required since 1 January 2026, from taxpayer invoice-field deadlines. Its September 2026 version places LC 116 subitems 1.03, 1.05 and 1.09 in the 1 December 2026 IBS/CBS-field cohort, distinct from the 1 October cohort for many other ISS services. These are scoped domestic-system rules, not proof that every foreign SaaS exporter must issue NFS-e. Our assessment is to have Finance classify the service and seller, confirm the applicable issuer and current transition timetable, and approve one procurement-ready invoice example before selling.[13]