Brazilian lenders must manage LGPD, BACEN, and CDC requirements in the same collections workflow. The LGPD, Law No. 13,709/2018, governs personal data collection, storage, and processing. BACEN, Banco Central do Brasil, sets guidance and resolutions for borrower-facing operations at regulated institutions. The CDC, Law No. 8,078/1990, sets consumer protections for collections. Meeting each framework separately is not enough. The program must handle their overlap by design.
This article explains each framework and the controls needed for automated collections across all three.
LGPD: Key Requirements for Collections
LGPD affects collections teams directly, not only IT. Its main collections requirements concern legal basis, data minimization, and borrower rights.
Legal basis. Collections usually rely on contract performance, where a valid loan agreement exists, or legitimate interest in recovering an overdue balance. First-party collections can generally meet this requirement when the agreement clearly explains data use. Third-party sharing and behavioral data from brokers or digital activity require a stronger basis or explicit consent, with documentation.
Data minimization. LGPD limits processing to what the stated purpose requires. Automated outreach generally needs account identification, overdue balance, days overdue, and channel preferences. Unneeded behavioral profiles add exposure with little collections value.
Borrower rights. Borrowers may access or correct data and, in some cases, restrict processing. Collections programs need a workflow for requests within LGPD timelines. Outreach systems should suppress accounts with active data rights requests.
BACEN Guidance on Borrower Contact
BACEN rules for financial institutions address customer contact during credit operations. Automated collections guidance centers on transparency, records, and proportionality.
Borrowers must know who is contacting them and why. WhatsApp, SMS, and email messages sent for a lender should identify it and offer a reply or human escalation path. Generic sender identity creates risk even when the purpose is legitimate.
Regulated institutions should keep contact records. Log the content, time, channel, and response for each attempt. Automated systems can create this audit trail programmatically, rather than relying on manual records.
BACEN does not set a hard contact cap, but contact must not become harassment. Simultaneous, frequent messages across channels, especially for small overdue balances, can attract scrutiny. A reasonable cadence is 2 to 3 attempts per week per borrower across channels, not per channel.
CDC: Prohibited Collections Practices
The CDC states more directly than LGPD or BACEN what debt collection cannot do. Article 42 bars ridicule, threats, and embarrassing or threatening collection methods. That rule applies to automated message tone.
Messages cannot imply criminal consequences for civil debt, threaten public exposure, or disclose the debt to family, employers, or social networks. Urgent escalation must remain professional notice, not intimidation.
Article 42-A requires clear information about the original debt, including creditor, amount owed, and charges. A message that mentions a debt without this identification is non-compliant regardless of tone.
WhatsApp collections require care because conversation can make professional notice feel like personal pressure. Casual familiarity combined with debt assertions may create CDC risk that a formal email template would avoid.
Where the Frameworks Intersect
LGPD governs data handling, BACEN governs institutional conduct, and the CDC governs consumer protection. Each applies to the same contact event.
For a compliant automated contact in Brazil, the data needs a valid LGPD basis, the message must identify the institution and offer recourse under BACEN expectations, and it must not coerce, threaten, or mislead under the CDC. Every send must meet all three conditions.
We built BLU365 controls into the send layer. Frequency caps limit contact. Templates undergo CDC tone review. Audit logs capture the metadata BACEN expects. Data access requests can immediately suppress accounts from outreach queues.
Compliance Is the Starting Point
Compliance is a prerequisite, not a collections strategy. Programs designed mainly to avoid violations can become too cautious and under-recover. Effective programs can also remain compliant.
Within LGPD, BACEN, and CDC limits, automated collections can be more frequent and personal than conservative manual outreach. The rules define boundaries, while careful design leaves room for stronger recovery without borrower-relations or regulatory problems.
Compliance should be a floor, not a reason to avoid better outreach. Regulators require lawful collections programs, not ineffective ones.