LGPD and sensitive fields in marketing and collections data

Marketing and collections data is full of personal data: CPF, phone, email, address. Brazil’s LGPD does not prohibit using that data. It requires that the use have a purpose, a legal basis and proportionate controls. This text organizes the concepts that come up most in daily work and shows the controls that help reduce exposure. It does not replace advice from your company’s legal team.

Personal data and sensitive personal data

The LGPD defines personal data as information related to an identified or identifiable natural person (art. 5, I). CPF, phone, email, name and address fall here.

Sensitive personal data is a specific category (art. 5, II): racial or ethnic origin, religious belief, political opinion, union membership or membership in a religious, philosophical or political organization, data about health or sex life, genetic or biometric data. Processing this data has stricter rules (art. 11).

In daily operations, many people call CPF and phone numbers “sensitive fields”, and DeepMiner uses that name too. The meaning is practical: these are the fields that identify a person directly and do the most harm if leaked. Legally, they remain personal data, under the rules of art. 7.

Purpose and legal basis

All processing needs a legitimate, specific purpose informed to the data subject (art. 6, I) and a legal basis (art. 7). The ones cited most in marketing and collections are:

• Consent (art. 7, I), common in marketing communications.
• Performance of a contract (art. 7, V), when the message is part of the contracted service.
• Legitimate interest (art. 7, IX), which requires assessing whether the use respects the data subject’s expectations and rights.
• Credit protection (art. 7, X), relevant for collections operations.

In practice, this becomes fields in your data. A marketing opt-in field, for example, goes in as a filter on every campaign strategy, so that only people who opted in receive messages.

Necessity: only what the purpose asks for

The necessity principle (art. 6, III) limits processing to the minimum required. In marketing data, it translates into two questions: do we need all of these fields? Do we need all of these records?

Enriching the whole dataset when only part of it will be contacted, or sending the full spreadsheet to someone for a count, are common examples of excess. Filtering before enriching and answering questions with aggregates instead of lists reduce the volume of personal data in circulation.

When AI queries the data

AI assistants that query customer data raise a new question: what goes to the model? In DeepMiner, fields named CPF, CNPJ, phone, mobile or email are recognized as sensitive. The model receives the name and type of those fields, never the values.

Those fields also have limits in queries. The assistant does not group results by them, and filters on them accept only equality comparisons, so nobody can list CPFs by asking. Dashboard tables do not display sensitive fields, and flow filters ask for the value to be typed instead of showing the list of values in the data.

Who sees what

Article 46 calls for security measures capable of protecting personal data from unauthorized access. A few controls help:

• Isolation per company. In DeepMiner, the platform is multi-tenant: one partner’s data never shows up for another.
• Access profiles. Users join by invitation, with the administrator, operator or viewer profiles, and access can be revoked.
• Protected credentials. Provider credentials are stored encrypted, and each provider’s webhook URL keeps only a signature of the token.

Data subject rights

Data subjects can request confirmation of processing, access, correction, anonymization, blocking or deletion, portability and information about sharing, among other rights in art. 18. Having your data in one place, with a key field and searchable records, makes it easier to find what belongs to a person when a request arrives.

Want to see these controls in practice? Book a demo.