Brazil Outbound Compliance: Anatel, LGPD, 0303

Quick answer

Outbound calling in Brazil is regulated by Agência Nacional de Telecomunicações for the network and the numbering, and by Autoridade Nacional de Proteção de Dados for the personal data under the Lei Geral de Proteção de Dados, with the Código de Defesa do Consumidor and the PROCON network enforcing consumer conduct. Consent is one of ten lawful bases under LGPD article 7, not the only one, and the opt-out machinery is sector-limited rather than national: Não Me Perturbe covers participating telecom providers and payroll-loan banks, while São Paulo runs a separate statewide block register that the caller itself must check before dialling. There is no federal calling-hours window: Anatel's rule for telecom operators says respect commercial hours without defining them.

If you dial Brazil at volume, the single most important thing that happened recently is the rewrite of the 0303 rule on 15 August 2025. The old framing, the one most published guides still repeat, was that telemarketing calls must present a 0303 prefix. That is no longer how the rule is built. The trigger is now volume rather than intent, it is measured per company group, it carries a 90 per cent floor, and it comes with an exemption for callers whose traffic is authenticated to Anatel's standard. Any Brazilian dialling plan written before September 2025 needs rereading.

At a Glance

Item	Position in Brazil
Regulator	Agência Nacional de Telecomunicações, Anatel, for the network and numbering. Autoridade Nacional de Proteção de Dados, ANPD, for personal data. The PROCON network and Senacon for consumer protection. ABR Telecom operates the Não Me Perturbe platform
Law and date	Lei nº 13.709/2018, the LGPD. Lei nº 8.078/1990, the CDC. Resolução Anatel nº 765/2023, the RGC, mostly in force from 1 September 2025. Ato Anatel nº 12.712/2024, the 0303 rule, as amended by Acórdão nº 201 of 14 August 2025
Licence needed	No telemarketing licence. The number is what gets authorised: the subscriber declares on the nSAPN system which activity a 303 resource will be used for, and Anatel may revoke the assignment. In São Paulo state a telemarketer must register with PROCON-SP before it may query the block list
Calling hours	Not published as clock times. RGC article 43 obliges telecom operators to respect horário comercial, which the RGC does not define, and no clock hours were found in the CDC, the LGPD, the São Paulo decree or the 0303 Ato
Consent model	LGPD article 7 gives ten lawful bases including legitimate interests. Where consent is used it must be written or otherwise demonstrable, highlighted in its own clause, specific rather than generic, and the controller carries the burden of proof. São Paulo requires written, individualised, time-limited authorisation on PROCON-SP's model
Do Not Call list	Não Me Perturbe, formalised by Anatel from 16 July 2019 and operated by ABR Telecom, covering participating telecom providers and payroll-loan banks only. Blocking takes up to 30 calendar days. Collections calls are expressly outside the block. São Paulo runs a separate statewide register with a genuine pre-call checking duty
Caller ID rule	The 0303 non-geographic code, triggered by generating more than 10,000 calls in at least one day across a monthly observation period, counted across the matriz and all filiais of the CNPJ. Qualifying callers must use 303 on at least 90 per cent of calls, displayed as 0303 followed by seven digits
Recording rule	Not published as a notice duty. No recording notice or consent rule specific to outbound commercial calls was found in the RGC, the CDC, the LGPD or the 0303 Ato. A recording is personal data, so LGPD articles 7 and 9 apply to it
Data protection law	LGPD, Lei nº 13.709 of 14 August 2018. Cross-border transfer under article 33 requires adequacy, proven guarantees such as standard contractual clauses, ANPD authorisation, or the data subject's specific and highlighted consent
Penalties	LGPD article 52 provides a simple fine of up to 2 per cent of Brazilian turnover, capped at BRL 50,000,000 per infringement, plus blocking, elimination and suspension of processing. CDC article 56 adds suspension of the service and of the activity. Anatel blocks the numbering resources themselves
Collections exposure	CDC article 71 makes abusive collection a criminal offence carrying three months to one year and a fine, and it expressly covers conduct that interferes with the consumer's work, rest or leisure. CDC article 42 doubles a wrongly collected amount on refund
Massive-call thresholds	Not published. RGC article 44 classifies massive calling as improper use of the network but defers the numeric parameters to a later instrument from the Superintendências

Who Regulates Outbound Calling in Brazil

Four bodies share the ground. Anatel regulates the network, the numbering plan and the conduct of telecom operators, and it is the source of both the 0303 numbering rule and the improper-use classification that can get your numbers blocked. The ANPD regulates personal data under the LGPD. The PROCON network, state and municipal, plus Senacon at federal level, enforce the Código de Defesa do Consumidor. ABR Telecom operates Não Me Perturbe for the telecoms sector and, with FEBRABAN and ABBC, for payroll-loan banks.

There is no telemarketing licence in Brazil, but the number you call from is effectively authorised. Under Ato nº 12.712/2024 the subscriber must tell its contracted operator which specific activity a 303 resource will be used for, and that declaration is registered on the nSAPN system at the moment of the request. The declared activities are active telemarketing, collections, donation requests, and other cases. The operator must verify the consistency of what the subscriber declares before requesting activation, and Anatel may revoke the assignment if the conditions are not met. The nSAPN record carries the subscriber's corporate name and CNPJ, and a reservation lapses if no contract with an operator is signed within ten days.

The 0303 Rule as Rewritten in August 2025

This is the headline. Item 9 of Anexo I to Ato nº 12.712/2024 was rewritten by Acórdão nº 201 of 14 August 2025, published in the Diário Oficial da União on 15 August 2025 and in force from publication.

The trigger is volume, not intent. The non-geographic code 303 is reserved for telecommunications services in which the subscriber generates an intense volume of calls in short periods directed at the general public, and intense volume is defined precisely: generating, regardless of whether the calls complete, more than 10,000 calls in at least one day across a monthly observation period, counting the total calls originated by all of the subscriber's access codes.

Aggregation is group-wide: all access codes associated with the CNPJ of the head office or any of its branches count as codes designated to the legal person, so splitting traffic across branch CNPJs does not reset the count. There is also a 90 per cent floor. A subscriber caught by the threshold must use the 303 code on at least 90 per cent of the total calls it generates, and may not use any other STFC, SCM or SMP access code to make intense volumes of calls. Networks present the virtual code on the called party's handset as 0303 followed by seven digits, and a 0303 code can also receive calls.

The 2025 amendment also created an escape hatch that did not exist before. Use of the numbering resource is optional for subscribers caught by the threshold provided the calls are authenticated and identified through a call-authentication system meeting the reliability and trustworthiness criteria adopted by the Agency. Which authentication systems Anatel has accepted is not named in the Ato, so treat the exemption as a route to confirm with your operator rather than a default position.

Enforcement runs through the operators. They must deploy the technical means to detect intense-volume callers, notify subscribers not using the CNG 303 so they conform within 60 days, except those using the authentication route, and then preventively block all of the subscriber's access codes used improperly for intense-volume calling until it regularises. They may not issue the subscriber new access codes until it migrates.

Consent and Opt-Out

The LGPD is not a consent-only law. Article 7 lists ten lawful bases: consent, legal or regulatory obligation, public administration, research, performance of a contract or pre-contractual steps at the data subject's request, exercise of rights in proceedings, protection of life, health, legitimate interests, and credit protection. Legitimate interests is available where fundamental rights and freedoms of the data subject do not prevail, which is the balance that decides most outbound marketing questions in Brazil.

Where consent is the basis, article 8 prescribes its form: in writing or by another means demonstrating the data subject's intention, sitting in a clause highlighted from the other contractual clauses if written, referring to determined purposes because generic authorisations are null, and provable by the controller, who carries the burden. Revocation must be free and facilitated, at any time, under article 8 paragraph 5.

São Paulo goes further for telemarketing specifically. A call to a number on the state register is lawful only if the caller can prove prior authorisation, and that authorisation must be written, individualised, time-limited, on a model made available by PROCON-SP, and held in custody by the caller for its whole term. Making supply of a product or service conditional on the consumer staying off the register, or on granting that authorisation, is classified as an abusive practice.

Do-Not-Call

Brazil's opt-out layer is two platforms and one state register, and none of them is economy-wide.

Não Me Perturbe was presented to Anatel and formalised for implementation by the providers from 16 July 2019. Registration blocks offers of payroll loans and payroll credit cards from participating banks and their selected correspondents, and offers of mobile telephony, fixed telephony, TV and internet from participating telecom providers. Nothing else is covered. A retailer, insurer or utility calling a registered number is not caught by the platform. The block takes up to 30 calendar days from the request.

The carve-outs matter as much as the coverage. The platform states expressly that the block does not apply to calls made to the consumer for data confirmation, fraud prevention, collections, or retention of portability requests, with or without an offer of refinancing and offers of other banking products and credit arrangements. Collections calls sit outside the block.

Anatel made the platforms binding on operators through the RGC: contracts must carry an opt-out clause, operators must publicise the platforms prominently, and it is prohibited to make the calls covered by article 43 to the access codes of consumers who have opted out through them.

São Paulo is the one place with a real pre-call checking duty on the caller, and a telemarketer must register with PROCON-SP before it may query the list. From the thirtieth day after a number is registered, telemarketing companies, the establishments using those services and individuals contracted for the purpose may not call it unless they can prove prior authorisation from the line holder, and they must consult the list before making a call of that nature. PROCON-SP publishes the registered numbers with their inclusion dates without identifying the holders, and consumers have 30 days to complain. How many other states run their own registers was not established, so treat state-level do-not-call as a per-state question.

Calling Hours and Days

Brazil has no published federal calling-hours window, and publishing one would be an invention. RGC article 43 requires providers making advertising calls or calls offering services and products to consumers to respect horário comercial, to observe a reasonable number of calls to each consumer, and to deal properly with complaints about unwanted calls. Horário comercial is not defined in the RGC, and no numeric value is given for a reasonable number of calls.

Note also who article 43 binds. It is addressed to as Prestadoras, the telecom operators' own outbound marketing, rather than to every Brazilian business. The generally applicable constraints are article 44 on improper use of the network, the 0303 numbering rule, the CDC, and the state block registers.

One common error is worth naming. Decreto nº 11.034/2022, the SAC decree, expressly does not apply to the offering and contracting of products and services. Its service-channel timings are inbound consumer-service rules and are not telemarketing hours.

What does discipline timing is the CDC. Article 42 bars exposing a defaulting consumer to ridicule, embarrassment or threat in the collection of debts, and article 71 criminalises any collection procedure that unjustifiably exposes the consumer to ridicule or interferes with their work, rest or leisure. That last phrase is the one that bites a collections campaign dialling at the wrong hour or too often.

Caller ID and Number Presentation

Beyond the 0303 regime, the RGC classifies as improper use of the network calls that are massive, meaning made in a volume greater than the human capacity to answer and communicate; calls made without the intention of effective communication; calls outside the numbering-plan rules; calls that unduly hinder identification of the caller; and calls to the access codes of users registered on the opt-out platforms. Improper use subjects those responsible to blocking, including of the numbering resources, and to the sanctions in the RASA.

The numeric parameters for massive and for the other categories are expressly deferred by article 44 to a later instrument from the competent Superintendências, and are not published here. Do not plan against any volume threshold other than the 10,000-calls-a-day 0303 trigger. The practical reading is otherwise simple: presenting a number that obscures who is calling is itself a violation, independent of 0303, so whatever caller ID you present should be one you are entitled to present, mapped to a campaign whose purpose matches the activity declared on nSAPN.

Call Recording and Notices

No recording notice or consent duty specific to outbound commercial calls was found in the RGC, the CDC, the LGPD or the 0303 Ato. That is an absence from the instruments reviewed, not a positive permission, so confirm the position with counsel before relying on it.

What is certain is that a recording is personal data. It needs a lawful basis under LGPD article 7, and the article 9 transparency duties apply: facilitated access to information about the processing, including the specific purpose, the form and duration of processing, the controller's identity and contact details, and any data sharing. The LGPD sets no retention period for recordings. The nearest fixed obligation is the São Paulo rule that a telemarketer must keep custody of the consumer's written authorisation for its whole term.

Messaging Rules for SMS and WhatsApp

No dedicated Brazilian instrument for marketing SMS or messaging apps was identified in the sources reviewed for this guide, so the governing layers are the LGPD for the personal data, the CDC for consumer conduct, and, where a consumer has opted out through Não Me Perturbe, the RGC prohibition on making the covered offers to that access code.

In practice that means the same discipline as voice: hold a lawful basis you can evidence, honour a revocation immediately and free of charge, keep the São Paulo authorisation rules in mind where you hold state-registered numbers, and treat collections messaging under CDC articles 42 and 71 rather than as marketing.

Data Protection and Retention

Cross-border transfer runs on LGPD article 33, which permits transfer in nine cases. The principal routes are transfer to countries or international organisations offering an adequate level of protection; guarantees provided and proven by the controller in the form of specific contractual clauses for a given transfer, standard contractual clauses, global corporate rules, or regularly issued seals, certificates and codes of conduct; ANPD authorisation; and the data subject's specific and highlighted consent to the transfer, given with prior information about its international character and clearly distinguished from other purposes.

The adequacy assessment is the ANPD's, weighing the destination's general and sectoral law, the nature of the data, observance of LGPD principles, security measures, and judicial and institutional guarantees, and the ANPD also defines the content of the standard contractual clauses. Whether it has published an adequacy list was not established, so the safe assumption for an offshore contact centre or cloud region is that you rely on clauses you can produce rather than on a country's status. Retention is not fixed by the LGPD: purpose limitation and necessity govern, and article 18 gives data subjects the right to elimination of data processed on consent.

Penalties and Enforcement

The LGPD's article 52 sanctions are a warning with a deadline for corrective measures; a simple fine of up to 2 per cent of the private legal entity's, group's or conglomerate's turnover in Brazil in its last financial year, excluding taxes, limited in total to BRL 50,000,000 per infringement; a daily fine subject to the same ceiling; publicising the infringement; blocking of the data concerned; elimination of the data concerned; partial suspension of the database for up to six months, renewable; suspension of the processing activity for up to six months, renewable; and partial or total prohibition of processing activities.

The CDC's article 56 sanctions are separate and can stop an operation: fine; seizure, destruction or deregistration of the product; prohibition of manufacture; suspension of supply of the product or service; temporary suspension of activity; revocation of a concession or permission; cassation of the establishment's licence; total or partial interdiction of the establishment or activity; administrative intervention; and counter-advertising, applicable cumulatively and by precautionary measure. The article 57 fine range is expressed in units of the UFIR index, from 200 to 3,000,000, graded by gravity, the advantage gained and the supplier's economic condition. The current value of the index each PROCON uses was not established, so no reais figure is published here. Breach of the São Paulo telemarketing decree is punished under CDC article 56.

Collections carries criminal exposure under CDC article 71, three months to one year and a fine, and article 42's sole paragraph entitles a consumer charged an undue amount to double what they overpaid, plus monetary correction and legal interest, save for justifiable error. Anatel's own sanctions run through the RASA and include blocking the numbering resources themselves, which for a dialler is the sanction that stops revenue the same day.

What Changed in 2025 and 2026

Two dates in 2025 changed Brazilian outbound materially.

On 15 August 2025 the 0303 rule was rewritten by Acórdão nº 201 of 14 August 2025. That is the version that introduced the more-than-10,000-calls-in-a-day test, the group-wide CNPJ aggregation, the 90 per cent floor, the call-authentication alternative, and the operators' duty to notify within 60 days and then block. Any guide still describing 0303 as a flat obligation on telemarketing calls is describing the pre-2025 rule.

On 1 September 2025 most of the RGC came into force. Under Acórdão nº 228 of 28 August 2024 only the sole paragraph of article 84 and articles 93 to 96 of Resolução nº 765/2023 were previously in force, with the remaining provisions taking effect from 1 September 2025. Articles 43 to 45, covering commercial hours, reasonable call volumes, the binding effect of the opt-out platforms and the improper-use classification, are therefore new law as of September 2025. Portaria Anatel nº 3.032 of the same date set the IPCA as the monetary-correction index for consumer refunds under the RGC.

Nothing newer was identified. No 2025 or 2026 Anatel resolution specifically on telemarketing was found, and a full-text search of Anatel's legislation index for telemarketing returns only Ato nº 12.712/2024, Resolução nº 765/2023 and two revoked Atos. Whether the ANPD issued any 2025 or 2026 regulation or enforcement decision was not examined, so check its index before a launch. Anatel also maintains a precautionary-measures page on abusive calls, referenced from the RGC as setting guidelines, restrictions and blocking mechanisms; its content was not read, and it is the most likely home of the deferred massive-call parameters.

How the Platform Supports Each Rule

DialerBee provides compliance-supporting controls that help you meet the obligations above. Brazil does not ship as a jurisdiction pack, so calling hours, do-not-call handling and consent are configured per tenant. The legal responsibility stays with the operator of the campaign.

Brazilian rule	Control that supports it
0303 presentation once you pass the volume threshold	Caller-ID pools owned exclusively per tenant, mapped per campaign with verified ownership
90 per cent of calls on the 303 code	Per-campaign caller-ID assignment, so the code follows the traffic rather than the trunk
Volume counted across the whole CNPJ group	Reporting on originated call volume per tenant and per campaign, exportable for review
Declared activity must match the traffic	Campaigns separated by purpose, with collections and marketing kept apart end to end
No calls to numbers opted out on the platforms	Your do-not-call list is imported once, then searched and checked on every attempt
São Paulo pre-call consultation of the state register	Multiple suppression lists per tenant, checked before the call is originated
Written, individualised, time-limited authorisation	Consent created, updated and revoked as auditable records with an expiry you set
Revocation must be free and facilitated	A revocation takes effect on the next attempt, not the next list refresh
Reasonable number of calls to each consumer	Configurable retry caps and cooling periods per contact
Calls must not obscure the caller's identity	Caller-ID ownership verified before a number can be presented on any campaign
Recordings are personal data under the LGPD	Recording with configurable retention, signed-URL playback, legal hold and per-tenant isolation
Brazilian Portuguese contacts reached in their own language	Language-aware AI across 11 languages, Portuguese included

Brazil Outbound Compliance Checklist

Measure your daily originated volume across every access code of the head office and all branches of the CNPJ.
Assume the 0303 regime applies the moment any single day exceeds 10,000 originated calls in a monthly observation period.
Move at least 90 per cent of qualifying traffic onto the 303 code, and stop using other access codes for intense-volume calling.
Ask your operator, in writing, whether it supports a call-authentication route Anatel accepts before relying on the exemption.
Declare the correct activity on nSAPN and keep the declaration matched to what the campaign actually does.
Register with PROCON-SP before querying the São Paulo block list, and consult the list before every call to a São Paulo number.
Hold written, individualised, time-limited authorisation for São Paulo registered numbers and keep it in custody for its term.
Scrub against Não Me Perturbe for payroll-loan and telecom offers, and remember the block does not cover collections.
Pick and document a lawful basis under LGPD article 7 for every list, and be ready to prove consent where consent is the basis.
Make revocation free and immediate, and honour it on the next dial attempt.
Keep collections conduct clear of CDC articles 42 and 71, including interference with the consumer's work, rest or leisure.
Set a documented retention period for recordings and contact data, since the LGPD sets none.
Evidence your article 33 transfer route before any offshore contact centre or cloud region goes live.
Re-read Anatel's precautionary-measures material on abusive calls before assuming any volume threshold other than the 0303 trigger.

Sources

Ato Anatel nº 12.712, de 4 de setembro de 2024, Anexo I item 9, as amended by Acórdão nº 201 de 14 de agosto de 2025, DOU 15 August 2025. Anatel Ato nº 12.712
Resolução Anatel nº 765, de 6 de novembro de 2023, Regulamento Geral de Direitos do Consumidor de Serviços de Telecomunicações. Anatel Resolução nº 765
Lei nº 13.709, de 14 de agosto de 2018, Lei Geral de Proteção de Dados Pessoais. Planalto LGPD
Lei nº 8.078, de 11 de setembro de 1990, Código de Defesa do Consumidor. Planalto CDC
Decreto nº 11.034, de 5 de abril de 2022, SAC. Planalto SAC decree
Decreto estadual SP nº 53.921, de 30 de dezembro de 2008, and Lei estadual SP nº 13.226/2008. ALESP Decreto nº 53.921
Não Me Perturbe, operated by ABR Telecom, formalised by Anatel from 16 July 2019. Não Me Perturbe

Frequently Asked Questions

What triggers the 0303 prefix in Brazil?

Volume, not intent. Since the August 2025 rewrite, the 303 code is required where a subscriber generates more than 10,000 calls in at least one day across a monthly observation period, regardless of whether the calls complete, counting the total originated by all of its access codes. All codes associated with the CNPJ of the head office or any branch count together, so splitting traffic across branches does not reset the total.

Does every telemarketing call in Brazil have to use 0303?

No, and that is the change most guides missed. The rule is now built around the volume threshold rather than around telemarketing as an activity. A subscriber below the threshold is not caught, and a subscriber above it must use 303 on at least 90 per cent of its calls, unless its calls are authenticated and identified through a call-authentication system meeting the criteria Anatel adopts.

What are the legal calling hours in Brazil?

There is no published federal window. RGC article 43 requires providers to respect horário comercial, and the RGC does not define it. No clock hours were found in the CDC, the LGPD, the São Paulo decree or the 0303 Ato. What does discipline timing is CDC article 71, which criminalises collection conduct that interferes with the consumer's work, rest or leisure.

Does Não Me Perturbe cover every Brazilian business?

No. Registration blocks offers of payroll loans and payroll credit cards from participating banks and their selected correspondents, and offers of mobile telephony, fixed telephony, TV and internet from participating telecom providers. A retailer, insurer or utility calling a registered number is not caught by the platform. Blocking takes up to 30 calendar days, and the platform states that collections calls are outside the block.

Do I need consent to call Brazilian consumers?

Not necessarily. The LGPD gives ten lawful bases in article 7, including legitimate interests where the data subject's fundamental rights and freedoms do not prevail. Where you do rely on consent it must be specific rather than generic, written or otherwise demonstrable, highlighted in its own clause if written, and provable by you. São Paulo separately requires written, individualised, time-limited authorisation on PROCON-SP's model for calls to registered numbers.

What can Anatel do if my numbers break the rules?

Operators must identify and notify subscribers not using the 303 code so they conform within 60 days, and then preventively block all access codes used improperly for intense-volume calling until the subscriber regularises. They may not issue new access codes in the meantime. Calls classified as improper use under RGC article 44 also subject those responsible to blocking, including of the numbering resources, and to the sanctions in the RASA.

What are the fines for a data protection breach in Brazil?

LGPD article 52 provides a simple fine of up to 2 per cent of the entity's, group's or conglomerate's turnover in Brazil in its last financial year, excluding taxes, limited in total to BRL 50,000,000 per infringement, alongside a daily fine under the same ceiling, publicising the infringement, blocking or elimination of the data, and suspension or prohibition of processing. The CDC adds its own sanctions, including temporary suspension of the activity.

Are collections calls treated differently in Brazil?

Yes, in both directions. They sit outside the Não Me Perturbe block, which the platform states expressly. They also sit inside CDC article 71, which makes it a criminal offence punishable by three months to one year and a fine to use threats, coercion, constraint, false statements or any procedure that unjustifiably exposes the consumer to ridicule or interferes with their work, rest or leisure.

Brazil Outbound Calling Compliance: Anatel and ANPD (2026)