Three threads are converging on automated collections in Brazil for 2026: tighter LGPD enforcement by ANPD, evolving BACEN expectations for digital contact, and CDC duties that automation still breaches through basic design errors. Lenders need to know where these rules apply and overlap to build a compliant, defensible program this year.
This post covers practical compliance, not legal advice. Review it with your legal and compliance teams for your specific operations.
LGPD Enforcement Is Now Practical
Lei Geral de Protecao de Dados (Lei No. 13.709/2018) took effect in August 2020, while ANPD enforcement grew through 2024 and 2025. For automated collections, LGPD is an operating constraint on collecting, storing, and using behavioral data for channel routing and personalization, not a one-time checklist.
Three LGPD articles directly affect collections automation.
Article 7, legal basis: Programs using engagement patterns, response history, opens, or payment-link interactions for routing and personalization must identify their processing basis. Legitimate interest, Art. 7, IX, is common but requires a documented balancing test specific to the activity. It is not blanket authorization.
Article 37, processing records: LGPD-covered organizations must keep a registro de operacoes de tratamento de dados pessoais. For collections, record borrower data categories, each legal basis, retention periods, and third-party processors, including the platform, WhatsApp Business API operators, and SMS gateways. A third-party platform also needs a DPA meeting Art. 37 requirements.
Article 46, security: Technical and administrative measures must protect data in transit and at rest. Share only what the messaging purpose requires. If WhatsApp needs a first name and account reference, it should not receive the full credit file. ANPD treats proportionality between shared data and purpose as a key compliance indicator.
BACEN Rules for Digital Borrower Contact
As of early 2026, BACEN, Banco Central do Brasil, has no standalone rule for automated WhatsApp or SMS collections. Its consumer protection and service framework still sets clear expectations for automated digital contact by regulated institutions.
Under Resolucao CMN 4.860/2020, digital messages should identify the institution, offer a way to ask questions or reply, and avoid deceptive content. A WhatsApp message that hides the institution or presents an automated campaign as personal creates compliance exposure.
BACEN keeps responsibility with the regulated lender for the substance and conduct of borrower communications, even when a third-party platform generates and delivers them. Outsourcing delivery does not transfer that responsibility. DPAs and operating agreements should say so clearly.
Lenders outside BACEN's direct perimeter, including some BNPL and marketplace lenders, remain subject to CDC collection rules. BACEN's framework is still a useful operational benchmark.
CDC Duties Automation Still Breaches
Codigo de Defesa do Consumidor (Lei No. 8.078/1990) sets debt-collection duties that automated programs often breach through template and sequencing errors, rather than intent.
Article 42 bars ridicule, embarrassment, threats, harassment, and false legal implications in debt collection. Two automated patterns create recurring Art. 42 exposure.
First, threat language. Saying an account will enter legal proceedings or that judicial action may begin, when no active or imminent process exists at that delinquency stage, breaches Art. 42. Old templates can persist in software libraries without legal review. PROCON offices and courts have acted on such cases.
Second, contact frequency. Repeated messages at short intervals, especially intrusive WhatsApp messages, can constitute harassment under Art. 42 interpretations used by PROCON. Three messages within 48 hours to a nonresponding borrower without a clear opt-out sits in a tested gray area.
Article 43 governs credit bureau records. If automation triggers reporting to Serasa or SPC, lenders must verify accuracy and notify the borrower of the negative record before or when reporting, as Art. 43 requires.
Documents Collections Programs Need
For a 2026 compliance review, the minimum documentation across all three frameworks is:
A collections-specific processing record, or ROPA, covering data categories, each legal basis, retention, third-party processors and roles, and procedures for access, correction, or deletion requests.
A DPA with each third-party platform receiving borrower data. It should cover processing scope, technical and organizational security, sub-processor approval, audit rights, and breach notices aligned with LGPD Art. 48 timelines.
A template review log against CDC Art. 42. Confirm that legal or judicial threats are not made without verified forthcoming action at that delinquency stage, and that sequence limits prevent harassment.
An opt-out and suppression process for every channel, including WhatsApp, SMS, and email, feeding one list checked before sending. A WhatsApp opt-out must stop further WhatsApp messages, even if another system missed the signal.
What This Does Not Restrict
Lenders often ask whether LGPD bars behavioral data for personalization. No, if the legal basis and records are in order.
Using prior WhatsApp engagement to route the current delinquency cycle can be legitimate-interest processing under LGPD if recorded in the ROPA and DPA. Fresh consent is not required when processing is documented, proportionate, and the borrower has not exercised objection rights under LGPD Art. 18.
Brazil's collections compliance picture is clearer and more actively enforced in 2026. Building records and operating controls before an ANPD inquiry or PROCON complaint costs less than responding after enforcement begins.