LGPD and Email Signatures (Brazil)

The Lei Geral de Protecao de Dados, Law 13.709 of 2018, known as the LGPD, is Brazil's data protection law, in force since September 2020 and enforced by the national data protection authority, the ANPD. It is closely modeled on the GDPR and applies to processing of personal data in Brazil, of people in Brazil, or for offering goods and services there. Like the GDPR, it does not specify email signature wording. Its influence on signatures is practical. The LGPD requires controllers to appoint a person in charge of data processing, the encarregado, and to publish their identity and contact details, so many Brazilian companies include a privacy or LGPD line in email footers linking to the privacy notice and the encarregado's contact. Confidentiality notices are common, often in Portuguese and English for international correspondence. The employee details in the signature are personal data, so they should be limited to what the role requires. Tracking pixels and tracked links in signatures produce personal data about recipients, which needs a legal basis under the LGPD and a mention in the privacy notice.