LGPD in marketing: 7 points to check before approving a tool

Before approving a tool that will process lead data, LGPD (Brazil's General Data Protection Law) in marketing requires checking seven points: the legal basis for processing, a designated data protection officer, isolation of your data, encryption in transit and at rest, audit logs, anonymization on demand, and revocation of access at the source. These are the items that legal and IT will ask about when the contract lands on their desk, and it is better to arrive with the answers than to go looking for them later.

It is worth starting with a distinction that changes the rest of the conversation. Your company is the data controller, because it is the one that decides why and how lead data is processed. The contracted tool is the processor, because it processes this data on the company's behalf. If the vendor makes a mistake, your company still answers for the processing, which is why evaluating the vendor technically is part of your job, not only legal's.

Below are the seven points, in the order in which they usually come up in an internal approval.

1. What is the legal basis for processing

Every collection of personal data needs a legal basis, and the LGPD lists ten of them in Article 7. Consent is the best known, and it is not always the most suitable for the sales routine. A resource download form usually relies on consent. Following up on a lead who became an opportunity in the CRM, on the other hand, almost always relies on contract performance or legitimate interest.

What to ask internally is straightforward: which legal basis supports each collection that the new tool will receive, and is it recorded somewhere? If the answer is "we have the form opt-in", check whether the opt-in text covers the use you intend to make. Data collected to receive an ebook and later used for active prospecting is the classic case of a stretched purpose.

This point depends on your company, not on the vendor. It comes first on the list because it defines what makes sense to ask in the other six.

2. Is there a designated data protection officer (DPO)

Article 41 of the LGPD requires the controller to appoint a data protection officer, and that this person's contact be made public. In practice, this is the channel through which a data subject asks for access, correction, or deletion of their data, and through which the national authority talks to the company.

When evaluating a vendor, look for the officer's contact on their website. If it is not published, ask. A company that processes third-party data and cannot say who is responsible for it will give you trouble at the first deletion request that arrives.

On your side, the test is the same. When a lead asks to be deleted, who receives that request and how long does it take to erase the record in all tools?

3. Is your data isolated from other customers' data

Practically every marketing platform today is multi-tenant: several customers using the same application. The question that matters is where the separation between them happens. With isolation only at the interface layer, a programming error can make a filter leak from one account to another. At the database layer, one organization's query does not reach another's records.

Ask the vendor at which layer data is isolated per customer. It is one of the few questions where the generic answer ("your data is safe") will not do. At Laiki, isolation happens at the database layer, by organization, and each account sees only its own data. This item is usually the one IT values most in the approval, because it is what they cannot verify on their own after the contract is signed.

4. Encryption in transit and at rest

These are two different things, and both need to exist. Encryption in transit protects the data while it travels between your website, the CRM, and the platform, and shows up as TLS or HTTPS. Encryption at rest protects the data while it is stored in the database, and shows up as a cipher standard, for example AES-256-GCM.

The translation for your decision is simple. Without encryption in transit, someone along the way can read what passes. Without encryption at rest, improper access to storage hands over the data in readable form. When the vendor cites both by name and standard, they have been through this conversation before. It is also worth checking where the infrastructure runs and how often there is a backup.

Resource · In PortuguesePrompt Guide for Marketing and Sales70 prompts with questions about marketing, sales and behavior to ask your data.Download the guide

5. Are there audit logs of who accessed what

An audit log is the record of who did what inside the platform: who viewed a list, who exported a report, who changed an integration. It serves two concrete situations. The first is the incident, when you need to reconstruct what happened. The second is the routine, when someone asks how a piece of data ended up in a certain place.

Without this record, the answer to either question becomes team memory. With it, it becomes a query. Ask whether the logs exist, what exactly they record, and how long they remain available. At Laiki, audit logs are in the Pro plan, along with anonymization on demand.

6. Anonymization and deletion on demand

Every data subject can ask for their data to be deleted, and your company needs to be able to comply. Anonymization is the middle path: the data that identifies the person is removed, and the behavior history remains useful for aggregate analysis. You keep the funnel's historical series without keeping the name and phone number of someone who asked to leave.

Ask whether the platform does this on demand, how long it takes, and whether the request has to go through support. And ask what happens to the data when the contract ends: is it returned, deleted, and how soon? This is usually the forgotten question at contracting, and it gets expensive when the answer only shows up at exit.

7. You can revoke access at the source

Here LGPD in marketing meets the integration routine. A data platform connects to your tools in two ways, and the control you keep changes in each.

For paid media and analytics accounts, the connection happens through a native OAuth2 credential. You authorize on the login screen of the source platform itself, the password is neither seen nor stored by the contracted tool, the scope is what Meta or Google grants, and revocation happens there at the source. If tomorrow you want to cut off access, you cut it off.

For other systems, such as CRM, forms, and chatbots, the connection happens through a workflow, with an access key. There, what you need to confirm is that this key is stored encrypted, isolated by organization, and that every integration action is recorded. We wrote in more detail about the two integration approaches and when each applies, because the choice between them is technical and affects exactly this control.

The questions to send to the vendor

The seven points above become this block of questions. Copy it, send it by email, and keep the answers together with the contract.

1. Do you act as a processor or as a controller of the data you receive from our operation, and what does the contract say about it?
2. Who is your data protection officer (DPO) and where is their contact published?
3. At which layer is each customer's data isolated: the interface or the database?
4. Which encryption standards do you use in transit and at rest?
5. Where does the infrastructure run, with which provider, and how often is there a backup?
6. Is there an audit log? What does it record, who can query it, and how long is it available?
7. Who on your side can see our data, and is that access recorded?
8. Do you anonymize or delete a data subject's data on demand? How long does it take and through which channel is it requested?
9. Are there subcontractors with access to our data? If so, which ones and for what?
10. How do we authorize access to our media accounts and the CRM, and how do we revoke that access whenever we want?
11. What happens to our data when the contract ends: return, deletion deadline, and how is it proven?
12. What is your process for reporting a security incident, and within how much time?

Two readings help when evaluating the answers. A short, specific answer usually comes from someone who has been through an audit. A long answer with no numbers usually comes from someone writing it for the first time.

What to do with this LGPD in marketing checklist

Take the seven points in writing and ask for the vendor's answers in writing too. Two things usually happen. The conversation with legal and IT gets shorter, because you arrive with the answers they were going to ask for. And the quality of the answers separates vendors quickly: whoever treats security as part of the product answers item by item, whoever treats it as a marketing page answers with adjectives.

On our side, the list is public and specific: compliance with the LGPD, a designated data protection officer, isolation by organization at the database layer, AES-256-GCM encryption and TLS/HTTPS, passwordless authentication, audit logs, anonymization on demand, and infrastructure on AWS with Cloudflare and daily backups. You can see how this is organized inside the product on the Laiki data platform page.

A scope warning is in order. No tool brings your operation into compliance on its own, because part of the work is yours: defining the legal basis, adjusting the opt-in texts, and responding to data subjects. What a good platform does is reduce the number of places where personal data is scattered, and responding to a deletion request gets much simpler when there is only one place to look.

Frequently asked questions

Does LGPD in marketing require consent for everything?

No. Consent is one of the ten legal bases provided for in the law, and others fit the sales routine well, such as contract performance and legitimate interest. What the law requires is that there be an adequate legal basis for each purpose, and that this purpose be informed to the data subject.

Who is responsible if the vendor leaks my leads' data?

Your company remains the controller of the processing, so it answers to the data subjects and the national authority, and then discusses liability with the processor. That is why technical evaluation before signing is worth more than any clause invoked after the incident.

Does connecting an AI agent to marketing data create a new risk?

The risk changes shape when access is not controlled. At Laiki, the agent queries what that user could already query, within the same compliance, with audit logs and anonymization on demand, and the customer decides when the agent is connected and what it queries.

Can you check these seven points without IT support?

You can gather all of them, because the questions are about decisions, not implementation. IT support helps in reading items 3, 4, and 7, which is why taking the completed checklist to the meeting with them speeds up approval.