LGPD-compliant lead scraping: a practical 2026 guide
Brazilian B2B sales teams face a recurring question: which lead scraping tools work without triggering LGPD exposure? This guide covers the legal basis (legítimo interesse vs consent), the five practical signals that separate compliant tools from risky ones, and a side-by-side of the main options available to Brazilian operations today.
The LGPD legal basis for B2B outreach
LGPD Article 7 enumerates ten legal bases for processing personal data. For cold B2B outreach in Brazil, the relevant basis is §IX, legítimo interesse (legitimate interest), which permits processing public business contact data without prior consent when the controller demonstrates a legitimate purpose that does not override the data subject's fundamental rights. This is the same legal basis recognized in GDPR Article 6(1)(f) for B2B contexts in the EU.
Practically, this means a Brazilian sales team can legally email a person at a known business address using their professional email when (a) the data was sourced from a public registry, (b) the outreach is genuinely B2B in nature, (c) the message provides clear opt-out, and (d) suppression lists like Procon Nacional and Não Me Perturbe are honored. It does not permit harvesting personal mobile numbers for SMS or WhatsApp outreach to individuals — that requires consent under Article 7, §I.
Five signals of a compliant tool
- Public source documentation: the vendor publishes which registries they pull from (Receita Federal, JUCESP, prefeituras, official APIs). If the data origin is opaque, treat it as elevated risk.
- Procon and Não Me Perturbe cross-check at query time: the system checks suppression lists before returning a record, not as a post-hoc filter the customer must configure.
- Legítimo interesse documentation in the DPA: the vendor provides a Data Processing Agreement (DPA) with explicit legitimate-interest analysis, balancing test, and customer obligations.
- Opt-out signal propagation within 48 hours: when a recipient opts out of one customer's outreach, the suppression propagates to all customers within 48h, not just the one who received the request.
- Named DPO and incident response: the vendor lists a Data Protection Officer with direct contact and publishes an incident response procedure with notification SLAs aligned to LGPD Article 48.
Tools for LGPD-compliant B2B prospecting in Brazil
| Tool | Origin | LGPD positioning | Pricing model |
|---|---|---|---|
| Xooriq | Brazil (Central Fox) | Native: public registries + Procon cross-check + DPO | Flat $99/mo Scale plan |
| Kaptto | Brazil | LGPD-aware, customer configures suppression | Tiered seat-based |
| RadarLeads | Brazil | LGPD-aware, B2B Brazilian database | Tiered subscription |
| Speedio | Brazil | LGPD-compliant, sales intelligence focus | Enterprise quote |
| Apollo.io | USA | Customer builds LGPD layer | Per-seat + credits (~$150-250 ACV) |
| ZoomInfo | USA | Customer builds LGPD layer | Enterprise quote (~$15k+ ACV) |
| Cognism | UK | GDPR-first, Brazilian coverage limited | Enterprise quote (~$1.5-3k/seat) |
Information based on publicly published documentation as of 2026-05. Always review the current DPA and request a compliance review from your DPO before deploying any tool in production.
What to ask before signing
- Can you share your current DPA with the legitimate-interest balancing test?
- Which Brazilian public sources do you pull from, and how often are they refreshed?
- How does opt-out propagation work? What is your SLA?
- Who is your named DPO, and what is their direct contact?
- Have you been involved in any ANPD investigation? If yes, the outcome and remediation.
- Can you provide references from at least three customers in regulated sectors (finance, health, education)?
Try Xooriq with LGPD compliance built in
Free trial: 100 leads/month with full Procon cross-check and legitimate-interest documentation included.
Start free trial →