BrazilDecree regulating the Positive Credit Registry Law: credit-history database managers, authorization, cancellation and incident reports
In force since .
A data brokers rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Licensing, Consent, Data subject rights, Breach notice, Security, Retention
What it requires
- Hold net equity of at least R$ 100,000,000, shown by financial statements audited by an independent auditor registered with the Securities Commission, and hold independent technical certifications of your platform security and information-security policy, renewed at least every three years and reviewed every year.
- Give a registered person's credit history to an enquirer only with the person's prior and specific authorization, and let the person revoke an authorization at any time.
- Let a registered person cancel or reopen the registry at any time, and suspend an enquirer's access to the person's credit score within two business days of the request, passing the request to the other managers.
- Report a leak of registered persons' information or another security incident that may cause relevant risk or harm to the Autoridade Nacional de Proteção de Dados, the Central Bank of Brazil or the National Consumer Secretariat, according to the data involved, within two business days of learning of it, and promptly notify the persons affected.
- Let only enquirers that keep or intend to keep a commercial or credit relationship with the registered person access the person's information, and keep policies and controls that ensure it.
- Give the registered person free access, on your website and by telephone, to the information you hold, the sources that supplied it, the managers it was shared with and the enquirers that saw the credit history and score in the previous six months.
- Keep the authorizations and the cancellation, reopening, deletion, revocation and correction requests on file for at least 15 years after the registry is cancelled.
These lines are LexLint's reading of the law's text.
What this law does
Decree 9,936 of regulates Law 12,414 of on databases of payment-performance information. A database manager must hold net equity of at least R$ 100,000,000, shown by financial statements audited by an auditor registered with the Securities Commission. A manager may give an enquirer a registered person's credit history only with that person's prior and specific authorization.
A registered person may ask a manager at any time to cancel or reopen the registry and to suspend enquirers' access to the credit score. A manager that receives a request to suspend access to the credit score must suspend that access within two business days. A manager must report a leak of registered persons' information or another security incident to the Autoridade Nacional de Proteção de Dados, the Central Bank of Brazil or the National Consumer Secretariat, according to the data involved.
The manager must make that report within two business days of learning of the incident. A manager must keep the authorizations and the cancellation, reopening, deletion, revocation and correction requests on file for at least 15 years after the registry is cancelled. The Decree took effect on its publication.
When LexLint raises it
When your app profile says your app provides financial services or processes personal data.
Back to the example · Lint your app
Page updated .