The LGPD (Brazil's data protection law) didn't put an end to B2B prospecting, but it changed how companies need to handle data. When it comes to using CNPJ (Brazilian company registry ID) databases and public information, it's essential to understand what is allowed, what isn't and which precautions to take to stay compliant.
1. Company data vs. personal data
The LGPD protects personal data, meaning information related to individuals. Purely corporate registration data (CNPJ, legal name, CNAE, address) is treated differently.
- Company data: CNPJ, legal name, business address, CNAE;
- Personal data: name, CPF (Brazilian individual taxpayer ID), personal email, personal phone number, among others;
- Mixed data: emails that directly identify a person (e.g., firstname.lastname@company.com).
In B2B prospecting focused on company information, most of the database consists of public corporate data, but that doesn't remove the need for care with individual contacts.
2. Public databases and legitimate interest
The LGPD provides legal bases for data processing. In B2B prospecting scenarios, the most common are:
- Legitimate interest: when there is a reasonable expectation of commercial contact between companies;
- Data made manifestly public: for example, information available in official gazettes and public registries.
The key point is demonstrating that the processing is proportionate, has a clear purpose (B2B prospecting) and respects data subjects' rights whenever personal data is involved.
3. Best practices when using lists for prospecting
Even in B2B, it's important to follow some operational safeguards:
Clear purpose
Use the data only to offer B2B products/services related to the company's profile.
Responsible segmentation
Avoid massive, indiscriminate campaigns; focus on compatible segments.
Transparency
If asked, explain where the data came from and which legal basis was used.
Respect opt-out
If someone asks not to be contacted anymore, honor it immediately and record the removal.
4. Internal organization and record keeping
The LGPD isn't just policy text; it's also process and governance. A few simple actions go a long way:
- Keep a record of the data sources used in prospecting;
- Document your legitimate interest assessment and target audience;
- Standardize how the sales team responds to LGPD-related questions;
- Provide a clear channel for data deletion or update requests.
This makes it easier to prove, in case of any inquiry, that the company acts responsibly and in line with the law.
5. The role of data platforms in compliance
Tools specialized in CNPJ data help reduce risk when they:
- Work with official, up-to-date sources;
- Clearly separate corporate data from potentially personal fields;
- Offer transparent terms of use and privacy policies;
- Have internal LGPD-aligned workflows for storing and handling information.
Even so, the final responsibility for using data correctly in prospecting always lies with the company running the campaigns.
Conclusion
It's entirely possible to run B2B prospecting with public data while still respecting the LGPD. The path forward involves understanding the difference between company data and personal data, applying best practices for segmentation and outreach, and staying transparent with the market. That way, your sales team gains efficiency without giving up legal certainty.