BrazilSUSEP Circular 638 of 2021, Cybersecurity Requirements for Insurers
Circular SUSEP nº 638, de 27 de julho de 2021, arts. 3º, 4º, 5º e 9º
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds an insurance company, an open private pension entity, a capitalization company or a local reinsurer supervised by the Superintendência de Seguros Privados (reached by declaring that you are an insurer). It applies from , with adaptation periods that ended on for segments S1 and S2 and on for segments S3 and S4 (article 17).
- Have a cybersecurity policy that contemplates at least your cybersecurity objectives, the commitment of your management bodies, and the parameters for classifying data, incidents and services and for outsourcing data processing and storage, compatible with your size, the nature and complexity of your operations and your exposure to cyber risk (article 4).
- Treat cyber risk as operational risk in your risk management framework, and observe national and international good practices on physical security, access control, encryption, protection against malware, data backups, activity logs, network protection and systems development and acquisition (article 3).
- Maintain effective, up-to-date processes, procedures and controls to identify and reduce vulnerabilities proactively and to detect, respond to and recover from incidents (article 5).
- Prepare an annual report on the prevention and handling of incidents, and send it to your management bodies, your audit and risk committees if any, and your internal controls director (article 9).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Superintendência de Seguros Privados, which applies the administrative penalties of article 108 of Decreto-Lei nº 73/1966 to an infraction of the norms on insurance and capitalization.
Settledness
- As of
- Open questions
- Does article 108 of Decreto-Lei nº 73/1966, as redrafted by Lei Complementar nº 213 of 2025, change the penalties that apply to a breach of the Circular?
What this law does
Article 4 requires a supervised entity to have a cybersecurity policy that contemplates, at a minimum, the cybersecurity objectives. Article 5 requires a supervised entity to have, and keep up to date, effective processes, procedures and controls to identify and reduce vulnerabilities proactively and to detect, respond to and recover from incidents.
Article 3 requires a supervised entity to observe national and international good practices in cybersecurity controls, including physical security, access control, encryption, protection against malware, data backups, activity logs, network protection and systems development and acquisition. Article 9 requires a supervised entity to prepare an annual report on the prevention and handling of incidents.
Article 1 of Circular SUSEP nº 638 sets cybersecurity requirements for insurers, open private pension entities, capitalization companies and local reinsurers. Article 18 provides that the Circular enters into force on . Article 108 of Decreto-Lei nº 73/1966 subjects a person responsible for an infraction of the norms on insurance, co-insurance, reinsurance, retrocession and capitalization to administrative penalties applied by the supervisory body.
When LexLint raises it
When your app profile says your app is an insurer.