Brazil

Article 9º-C, inserted into Resolução TSE nº 23.610/2019 by Resolução TSE nº 23.732/2024, forbids using fabricated or manipulated content in electoral advertising, in any form, to spread notoriously untrue or gravely decontextualized facts with the potential to harm the balance of the election or the integrity of the electoral process.

Paragraph 1 specifically prohibits using synthetic audio, video, or combined audio-video content generated or digitally manipulated, even with the depicted person's authorization, to create, replace, or alter the image or voice of a living, deceased, or fictitious person, to harm or benefit a candidacy (a deep fake).

Paragraph 2 makes a violation of the caput or paragraph 1 an abuse of political power and improper use of the means of social communication, exposing the responsible candidacy to loss of its electoral registration.

Article 9º-B, inserted into Resolução TSE nº 23.610/2019 by Resolução TSE nº 23.732/2024, requires that any use in electoral advertising of synthetic multimedia content generated by AI or equivalent technology, to create, replace, omit, merge, alter the speed of, or overlay images or sounds, carry an explicit, prominent, and accessible disclosure that the content was fabricated or manipulated and which technology was used.

Paragraph 1 requires that disclosure at the start of audio pieces, by a watermark label and audio description for static images, and in both forms for video or combined audio-video pieces. Paragraph 2 excludes image- or sound-quality adjustments, graphic identity elements, and customary marketing techniques such as composite campaign photos from the duty.

Paragraph 3-A, added by Resolução TSE nº 23.755, de 2 de março de 2026, bars the publication and republication, even free of charge, and the paid boosting of new synthetic content produced or altered by AI or equivalent technology that uses the image, voice or statement of a candidate or a public figure, even where labeled, from 72 hours before to 24 hours after the end of the election.

Paragraph 5, added by the same resolution, requires an internet application provider that offers paid boosting of political-electoral content to provide a specific field in which the advertiser declares the use of AI or equivalent technology. The duty binds whoever is responsible for the advertising, which reaches a candidate, party, federation, or coalition, or a service that generates or places AI content on their behalf.

Article 6 requires the controller to notify the ANPD of a security incident within three business days, unless a specific law sets another period. The three business days run from the moment the controller learns that the incident affected personal data.

An incident may create relevant risk or damage to data subjects when it can significantly affect their fundamental interests and rights and involves at least one of sensitive data, data of children, adolescents or the elderly, financial data, system authentication data, data under legal, judicial or professional secrecy, or large-scale data. Article 9 requires the controller to notify the affected data subjects within the same three business days.

Where direct and individual notice is not feasible or the data subjects cannot be identified, the controller must still announce the incident, within the same period, through means such as its website, applications, social media and service channels, in a way that keeps it visible for at least three months.

Article 10 requires the controller to keep a record of every security incident, including one not reported to the ANPD or to data subjects, for at least five years from the date of the record. The period for notifying the ANPD is counted double for small-scale processing agents.

Article 48 requires the controller to notify the ANPD and the data subject of a security incident that may create relevant risk or harm to data subjects.

The notification runs on a reasonable period the ANPD itself defines by regulation rather than a fixed number of hours or days stated in the LGPD, and paragraph 1 requires it to describe, at minimum, the nature of the personal data affected, information about the data subjects involved, the technical and security measures used, the risks related to the incident, the reasons for any delay, and the measures taken or planned to reverse or mitigate the harm.

Paragraph 2 lets the ANPD assess the incident's gravity and order the controller to give the incident wide publicity in the media or to adopt measures reversing or mitigating its effects, and paragraph 3 lets the ANPD weigh, in that assessment, whether the controller had already rendered the affected data unintelligible to unauthorized third parties.

Article 3 requires the appointment of a data protection officer, called the encarregado, to be made by a formal written, dated and signed act that states how the officer acts and what the officer does. A public body must appoint an officer when it processes personal data, and article 5 requires the appointment to be published in the official gazette of the Union, the state, the Federal District or the municipality. Appointment of an officer by a processor is optional.

Small-scale processing agents exempted from appointing an officer must offer data subjects a communication channel. Article 9 requires the officer's identity and contact details to be published clearly and prominently on the agent's website. Article 10 requires the agent to give the officer the human, technical and administrative means to work, technical autonomy, and direct access to senior management.

Article 19 allows the officer to hold other roles and to serve several agents only if the duties can be fully performed and no conflict of interest arises, such as a role that decides strategically on the processing. A conflict of interest can lead to an administrative sanction under article 52 of the LGPD.

The LGPD applies to any operation processing personal data by a natural or legal person, public or private, wherever performed, when the operation happens in Brazil, aims to offer goods or services to a person in Brazil, or processes data collected in Brazil, and article 4 exempts processing for exclusively personal and non-economic purposes, for journalistic, artistic or academic purposes, for public safety, national defense, state security or criminal investigation and enforcement under specific legislation, and data originating outside Brazil that is never shared with a Brazilian controller or transferred onward.

Article 5 defines the personal data, controller, operator and encarregado (data protection officer) roles that anchor the regime, and its most recent redação, given by Lei nº 15.352, de 2026, confirms that the body those roles report to is now the Agência Nacional de Proteção de Dados (ANPD), not the Autoridade Nacional de Proteção de Dados the LGPD originally created.

Article 6 states the purpose limitation, necessity, transparency, security and accountability principles that govern every processing operation, and article 7 lists ten lawful bases for ordinary personal data, from consent to legitimate interest, while article 8 sets consent's formal requirements, including a clause set apart from other contract terms and a burden of proof on the controller.

Article 9 requires clear, adequate and prominent information about the processing, and article 10 conditions a legitimate-interest basis on strictly necessary data and transparency measures. Articles 15 and 16 require personal data to be deleted once processing ends, unless retention is needed for a legal obligation, anonymized research, an authorized transfer, or the controller's own anonymized use.

Articles 23 to 32 require a public body to publish the legal basis, purpose and procedures for any processing it carries out, bar it from transferring personal data to a private entity outside the listed cases, and let the ANPD demand a report or issue guidance where a public body's processing violates the law.

Article 37 requires a record of processing operations, especially those resting on legitimate interest, article 38 lets the ANPD demand a data protection impact report, and article 41 requires the controller to name an encarregado and publish their contact details.

Articles 46, 47 and 49 require technical and administrative security measures against unauthorized access and accidental or unlawful destruction, loss, alteration or improper processing, from a product's design through its operation, and articles 50 and 51 encourage a governance program with internal rules, risk-mitigation mechanisms and complaint channels.

Article 9 allows an international transfer of personal data only for legitimate, specific, explicit purposes informed to the data subject, resting on a legal basis under article 7 or 11 of the LGPD and on a valid transfer mechanism. The valid mechanisms are an ANPD adequacy decision, standard contractual clauses, global corporate rules, specific contractual clauses, or the hypotheses in article 33, items II(d) and III to IX, of the LGPD.

Article 16 makes a transfer on standard contractual clauses valid only if the exporter and importer adopt the text of Annex II in full and without alteration. Article 17 requires the controller to give a data subject, on request, the full text of the clauses used for the transfer, within 15 days unless specific ANPD regulation sets another period. Article 17, paragraph 2 also requires the controller to publish on its website a plain-language document in Portuguese about the transfer.

The ANPD approves specific contractual clauses only when standard clauses cannot be used because of exceptional circumstances of fact or law that the controller proves. Article 28 requires global corporate rules to be submitted to the ANPD for approval. Article 6 provides that an international collection of data is not an international transfer.

Parties that use contractual clauses for international transfers had to incorporate the ANPD's standard clauses into their contracts within 12 months of the Resolution's publication.

Article 33 permits international transfer of personal data only to a country or international organization offering an adequate level of data protection, where the controller proves compliance through specific or standard contractual clauses, global corporate rules, or a certification seal, for international legal cooperation among investigative or prosecutorial bodies, to protect life or physical safety, where the ANPD authorizes the transfer, under an international cooperation commitment, for a public-policy purpose given publicity, or with the data subject's specific, highlighted consent given after being told the operation is international.

Article 34 requires the ANPD to weigh the destination country's or organization's general and sectoral rules, the nature of the data, the LGPD's principles and rights, its security measures, and its judicial and institutional guarantees before finding its protection adequate.

Article 35 gives the ANPD authority to define standard contractual clauses and to verify specific clauses, global corporate rules, or certification seals, including through a certifying body it may designate and review, and article 36 requires any change to safeguards the ANPD accepted as sufficient to be reported to it.

Article 20, in the wording given by Lei nº 13.853, de 2019, gives a data subject the right to request review of a decision taken solely on automated processing of their personal data that affects their interests, including a decision defining their personal, professional, consumer, or credit profile or an aspect of their personality. The article's original 2018 text specified review by a natural person, and the 2019 amendment removed that qualifier, leaving only a right to request review.

Paragraph 1 requires the controller to provide, on request, clear and adequate information about the criteria and procedures used for the automated decision, subject to trade and industrial secrecy. Paragraph 2 lets the ANPD audit the processing for discriminatory effects where the controller withholds that information on a trade-secrecy basis.

Article 17 assures every natural person title to their own personal data and the fundamental rights of liberty, intimacy and privacy that the LGPD protects.

Article 18 gives the data subject the right to confirm processing exists, access, correct, anonymize, block, delete, or port their data to another provider, learn which public and private entities the controller shared their data with, learn the consequences of withholding consent, and revoke consent at any time through a free and easy procedure, and article 19 requires the controller to answer a confirmation or access request immediately in simplified form or within 15 days with a full, clear statement of the data's origin, the criteria used, and the treatment's purpose.

Article 21 bars using data about a data subject's exercise of their own rights to their detriment, and article 22 lets the data subject or a representative defend these rights in an individual or collective judicial action.

Article 5 subjects every regulated agent to the ANPD's inspection and lists duties it owes, among them to provide the documents, data and information the ANPD asks for in the period, place and format it sets. Regulated agents must also allow access to their facilities, equipment, systems and records, submit to audits the ANPD carries out or orders, and provide a representative able to support the ANPD's work.

Article 6 provides that failing these duties may amount to obstruction of the ANPD's inspection activity, which exposes the agent to repressive measures. Under article 8 the periods in the Regulation start from official notice and are counted in business days.

Article 42 makes a controller or operator that causes patrimonial, moral, individual, or collective damage through personal-data processing in violation of the data-protection legislation liable to repair it, holds an operator jointly liable when it breaches the legislation or departs from the controller's lawful instructions, lets a court shift the burden of proof to the controller where the data subject's claim is plausible, and lets the reparation claim proceed collectively in court.

Article 52 subjects a controller or operator to administrative sanctions the ANPD applies after a due process guaranteeing full defense, from a warning with a correction deadline through a simple fine of up to 2% of the private legal entity's, group's, or conglomerate's revenue in Brazil in its last fiscal year, excluding taxes, capped in total at R$50,000,000.00 per infraction, a daily fine observing the same cap, publicity of the confirmed infraction, blocking or deletion of the data at issue, and suspension of the database or the processing activity for up to six months, renewable once.

Articles 53 and 54 require the ANPD to publish, after public consultation, the methodology it uses to calculate a fine's base value and to ground a daily fine's amount in the violation's gravity and the harm caused.

Article 55-A creates the supervisory authority as a special autarchy; its most recent redação, given by Lei nº 15.352, de 2026, names it the Agência Nacional de Proteção de Dados (ANPD) rather than the Autoridade Nacional de Proteção de Dados the LGPD first created in 2018, and links it to the Ministério da Justiça e Segurança Pública with functional, technical, decision-making, administrative, and financial autonomy.

Article 55-J gives the ANPD the power to issue rules, demand information from any controller or operator at any time, receive and act on data-subject complaints, and inspect and sanction noncompliant processing through a process that guarantees the defendant's defense and right of appeal.

Articles 58-A and 58-B create a National Council on Data Protection and Privacy with representatives of government, the legislature, the judiciary, and civil society to advise the ANPD and propose data-protection and privacy policy.

The civil-liability chapter and the ANPD's own creation took effect with the LGPD's general provisions on 18 September 2020, but the administrative-sanctions chapter, articles 52 to 54, did not take effect until 1 August 2021, under article 65, I-A, added by Lei nº 14.010/2020.

Article 7 requires a provider of an information-technology product or service directed at children and adolescents, or likely to be accessed by them, to configure it by default to the most protective privacy and data-protection setting available, and article 7, paragraph 2 bars processing their personal data in a way that causes, facilitates or contributes to a violation of their privacy.

Article 16, sole paragraph, requires a controller processing their data, above all for purposes not strictly necessary to run the product or service, to map the risks and make efforts to mitigate them, and to prepare a data-protection impact, monitoring and evaluation report that is shared when the authority requests it.

Article 22 bars profiling techniques to direct commercial advertising at children and adolescents, and article 26 bars building behavioral profiles of them from their personal data, including data obtained in age verification, for that advertising. The law applies to a covered product or service regardless of where it is located, developed, made, offered, marketed or operated, and article 41-A fixed 17 March 2026 as the date it enters into force.

Article 5, II defines sensitive personal data as data about racial or ethnic origin, religious conviction, political opinion, union or religious, philosophical or political association, health or sex life, or genetic or biometric data tied to a natural person, and article 11 confines its processing to specific, highlighted consent or a narrow list of alternative bases: a legal or regulatory obligation, a public-policy purpose, research with anonymization where possible, the exercise of a right, protecting life or physical safety, health treatment, or fraud prevention and authentication safeguards.

Article 11, paragraph 4 bars sharing sensitive health data between controllers for economic advantage, except for data-subject-requested portability or the health-service, pharmaceutical and health-assistance transactions the provision lists, and bars a health-insurance operator outright from using health data to select risks in contracting or excluding beneficiaries.

Article 12 excludes anonymized data from the definition of personal data unless the anonymization can be reversed with the controller's own means or reasonable effort, and treats data used to build an identifiable behavioral profile as personal data again. Article 13 lets a research body access personal data for public-health studies only within a controlled and secure environment, anonymized or pseudonymized where possible, and bars any transfer of that data to a third party.

Article 14 requires a child's or adolescent's data to be processed in their best interest, with specific, highlighted consent from at least one parent or legal guardian, except to contact the parent once without storing the data or to protect the child, bars conditioning participation in a game, application or activity on more personal data than the activity strictly needs, and requires the controller to make reasonable efforts, considering available technology, to verify that the consent came from the responsible adult.

Article 154-A punishes invading another person's computing device, whether or not connected to a network, to obtain, alter, or destroy data or information without the device user's express or tacit authorization, or to install a vulnerability to obtain an unlawful advantage, with reclusão of 1 to 4 years and a fine under the wording Lei nº 14.155/2021 gave the offense, up from the original Lei nº 12.737/2012 penalty of detention of 3 months to 1 year and a fine.

Section 2 raises the penalty by one third to two thirds if the invasion causes economic loss.

Section 3 sets a separate penalty of reclusão of 2 to 5 years and a fine where the invasion obtains the content of private electronic communications, trade or industrial secrets, confidential information as defined by law, or unauthorized remote control of the invaded device, and section 4 raises that penalty by one third to two thirds where the obtained material is disclosed, marketed, or transmitted to a third party.

Because the offense's trigger is invading a device, a scraper reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision.

Article 7, XIII protects a database, along with a collection, compilation, anthology, encyclopedia, or dictionary, as an intellectual creation where its selection, organization, or arrangement of content amounts to one, and article 7, § 2º expressly states that this protection does not cover the underlying data or materials themselves and is without prejudice to any copyright that subsists in that data.

Article 87 gives the holder of the patrimonial right over a database the exclusive right to authorize or prohibit reproducing it in whole or in part, translating, adapting, reorganizing, or otherwise modifying it, distributing the original or copies, or communicating it to the public, and reproducing, distributing, or communicating the results of such a modification.

Because the protection reaches only the database's selection and arrangement, and not the data itself, Brazil has no sui generis, investment-based extraction right of the kind the European Union's Database Directive creates, and the Act predates the concept of a machine-readable text-and-data-mining reservation, so no opt-out mechanism of that kind exists.

Article 7 assures an internet user rights including inviolability of intimacy and private life, secrecy of the flow of their internet communications except by judicial order, and secrecy of their stored private communications except by judicial order.

Article 10 requires that the retention and disclosure of connection and internet-application-access records, personal data, and the content of private communications observe the intimacy, private life, honor, and image of the parties involved, and article 10, § 1º limits disclosure of records associated with personal data or other identifying information to a judicial order.

Article 12 authorizes a warning, a fine of up to 10% of the economic group's revenue in Brazil in its last fiscal year, excluded taxes, temporary suspension, or prohibition of activity for violations of articles 10 and 11, which extend Brazilian law and these privacy, personal-data, and communications-secrecy rights to any collection, storage, custody, or processing of records, personal data, or communications where at least one such act occurs in Brazilian territory, including where performed by a foreign company that offers a service to the Brazilian public.

These duties bind an internet application provider regardless of how it collected the records, personal data, or communications, including by scraping, so long as at least one act of collection, storage, custody, or processing occurs in Brazilian territory.

A manufacturer or supplier of specified consumer customer-premises equipment, meaning a cable modem, xDSL modem, ONU or ONT, fixed-wireless-access or satellite-broadband router or modem, or wireless router or access point sold in Brazil to connect a subscriber to an internet service provider's network, must meet mandatory minimum cybersecurity requirements before Anatel will certify the device.

The device may carry no default, blank, or weak passwords and no password shared across all units as manufactured. It may also carry no credentials or cryptographic keys hard-coded in the device's software or firmware. The manufacturer must provide at least two years of free security updates after launch or for as long as the product stays on the market, whichever is longer.

It must also maintain a published, securely reachable channel plus a coordinated vulnerability-disclosure policy for reporting a security flaw. Anatel enforces the requirement through the device's conformity assessment (homologação) and can suspend a product's homologação, which bars its distribution in Brazil, if it later finds a security flaw.

Article 1 applies the Resolution to concessionaires, permit holders and authorized operators of electric-power services or facilities and to the entities responsible for system operation, energy trading or the management of sector charges. Article 4 requires the cybersecurity policies to contain, at a minimum, the content it lists. Article 4 requires the policies to provide for applying at least one cybersecurity maturity model every year.

Article 5 requires the policy to be approved by the Board of Directors or an equivalent collegiate body. Article 5 requires the agent to designate an officer responsible for the cybersecurity policy. Article 9 requires agents to keep records and to send ANEEL or the designated sectoral coordination team, on request, the maturity model results, the cyber risks identified with their treatment, and the data of the incident response teams. Article 11 states that the Resolution enters into force on 1 July 2022.

Article 2 of the Regulation applies to all providers of collective-interest telecommunications services, except small providers. Article 6 requires the company to prepare, implement and maintain a Cybersecurity Policy. Article 7 requires a provider to use telecommunications products and equipment from suppliers that hold a compatible cybersecurity policy and undergo periodic independent audits.

Article 13 requires the Cybersecurity Policy to be approved by the board of directors or an equivalent collegiate body. Article 19 requires the vulnerability assessment cycles to be carried out by an independent assessment body or qualified company. Article 20 requires a provider to send Anatel information on its Critical Telecommunications Infrastructures, covering at least network data and geographic mapping of physical structures and routes.

Article 25 subjects an infringement of the Regulation to the administrative sanctions of Law 9,472 of 16 July 1997. The approving Resolution states that it enters into force on 4 January 2021. Article 27 requires a provider to comply with the Regulation within 180 days of its entry into force.

Article 1 of Resolução BCB nº 85, as redrafted by Resolução BCB nº 552 of 3 March 2026, applies the Resolution to payment institutions, securities brokers and dealers, foreign-exchange brokers and virtual asset service providers authorized to operate by the Banco Central do Brasil.

Article 2 of the Resolution requires the institutions to implement and maintain a cybersecurity policy built on principles and guidelines that seek to ensure the confidentiality, integrity and availability of the data and information systems used. Article 6 of the Resolution requires the institutions to establish a plan of action and incident response aimed at implementing the cybersecurity policy.

Article 7 of the Resolution requires the institutions to designate a director responsible for the cybersecurity policy and for executing the plan of action and incident response. Article 8 of the Resolution requires the institutions to prepare an annual report on the implementation of the plan of action and incident response, with a base date of 31 December. Article 27 provides that the Resolution enters into force on 1 August 2021.

Article 3, item I, of Lei nº 13.506/2017 makes it an infraction to carry out operations in the National Financial System or the Brazilian Payment System in disagreement with the principles of the legal and regulatory norms that govern the activity the Banco Central do Brasil has authorized. Article 5 of Lei nº 13.506/2017 applies the penalties of public admonition, fine, bans on services and activities, disqualification of managers and withdrawal of authorization, alone or cumulatively.

Article 1 of Resolução CMN nº 4.893 applies the Resolution to the institutions authorized to operate by the Banco Central do Brasil, and its sole paragraph, as redrafted from 1 March 2024, excludes consortium administrators, payment institutions, securities brokers and dealers, and foreign-exchange brokers.

Article 2 of the Resolution requires the institutions to implement and maintain a cybersecurity policy built on principles and guidelines that seek to ensure the confidentiality, integrity and availability of the data and information systems used. Article 3 of the Resolution requires the cybersecurity policy to contemplate, at a minimum, the institution's cybersecurity objectives and the procedures and controls adopted to reduce the institution's vulnerability to incidents.

Article 6 of the Resolution requires the institutions to establish a plan of action and incident response aimed at implementing the cybersecurity policy. Article 7 of the Resolution requires the institutions to designate a director responsible for the cybersecurity policy and for executing the plan of action and incident response.

Article 8 of the Resolution requires the institutions to prepare an annual report on the implementation of the plan of action and incident response, with a base date of 31 December. Article 28 provides that the Resolution enters into force on 1 July 2021.

Article 3, item I, of Lei nº 13.506/2017 makes it an infraction to carry out operations in the National Financial System or the Brazilian Payment System in disagreement with the principles of the legal and regulatory norms that govern the activity the Banco Central do Brasil has authorized. Article 5 of Lei nº 13.506/2017 applies the penalties of public admonition, fine, bans on services and activities, disqualification of managers and withdrawal of authorization, alone or cumulatively.

Article 4 requires a supervised entity to have a cybersecurity policy that contemplates, at a minimum, the cybersecurity objectives. Article 5 requires a supervised entity to have, and keep up to date, effective processes, procedures and controls to identify and reduce vulnerabilities proactively and to detect, respond to and recover from incidents.

Article 3 requires a supervised entity to observe national and international good practices in cybersecurity controls, including physical security, access control, encryption, protection against malware, data backups, activity logs, network protection and systems development and acquisition. Article 9 requires a supervised entity to prepare an annual report on the prevention and handling of incidents.

Article 1 of Circular SUSEP nº 638 sets cybersecurity requirements for insurers, open private pension entities, capitalization companies and local reinsurers. Article 18 provides that the Circular enters into force on 1 September 2021. Article 108 of Decreto-Lei nº 73/1966 subjects a person responsible for an infraction of the norms on insurance, co-insurance, reinsurance, retrocession and capitalization to administrative penalties applied by the supervisory body.

Article 6 requires agents to notify the designated sectoral coordination team of the higher-impact cyber incidents that substantially affect the security of installations, operations, services to users or data. Article 6 requires the notification to be made as soon as the agent is aware of the incident and its size. Article 6 requires the notification to include an analysis of the cause and impact and the mitigation actions adopted.

Article 7 requires agents to adopt a procedure for sharing information on threats in a confidential and non-discriminatory way. Article 11 states that the Resolution enters into force on 1 July 2022.

Article 9 requires a provider to notify Anatel and to inform other providers and users, as the case may be, of the relevant incidents that substantially affect network security and user data. Article 17 requires a provider to notify Anatel of the relevant incidents that substantially affect the security of telecommunications networks and of user data. Article 17 requires the notification to include an analysis of the cause and impact and the mitigation actions adopted.

Article 17 leaves the form and procedure of the notification to the technical group GT-Ciber. Article 2-C requires a provider to notify Anatel where a security incident must be communicated to the national data protection authority. Article 18 requires providers to adopt a procedure for sharing information on relevant incidents in a confidential and non-discriminatory way. Article 25 subjects an infringement of the Regulation to the administrative sanctions of Law 9,472 of 16 July 1997. Article 27 requires a provider to comply with the Regulation within 180 days of its entry into force.

Article 20, item III, of Resolução BCB nº 85 requires the risk management procedures of the institutions to specify timely communication to the Banco Central do Brasil of the occurrence of relevant incidents and of interruptions of relevant services that constitute a crisis situation for the institution, together with the measures to restart its activities.

Article 20 applies that requirement to the risk management procedures the institutions adopt under the regulation in force, in respect of business continuity. Article 22 requires the institutions to develop initiatives for sharing information on the relevant incidents referred to in article 3, item IV. Article 27 provides that the Resolution enters into force on 1 August 2021.

Article 1 of Resolução BCB nº 85, as redrafted by Resolução BCB nº 552 of 3 March 2026, applies the Resolution to payment institutions, securities brokers and dealers, foreign-exchange brokers and virtual asset service providers authorized to operate by the Banco Central do Brasil.

Article 3, item I, of Lei nº 13.506/2017 makes it an infraction to carry out operations in the National Financial System or the Brazilian Payment System in disagreement with the principles of the legal and regulatory norms that govern the activity the Banco Central do Brasil has authorized. Article 5 of Lei nº 13.506/2017 applies the penalties of public admonition, fine, bans on services and activities, disqualification of managers and withdrawal of authorization, alone or cumulatively.

Article 20, item III, of Resolução CMN nº 4.893 requires the risk management procedures of the institutions to contemplate timely communication to the Banco Central do Brasil of the occurrence of relevant incidents and of interruptions of relevant services that constitute a crisis situation for the institution, together with the measures to restart its activities.

Article 20 applies that requirement to the risk management procedures the institutions adopt under the regulation in force, in respect of business continuity. Article 22 requires the institutions to develop initiatives for sharing information on the relevant incidents referred to in article 3, item IV. Article 28 provides that the Resolution enters into force on 1 July 2021.

Article 1 of Resolução CMN nº 4.893 applies the Resolution to the institutions authorized to operate by the Banco Central do Brasil, and its sole paragraph, as redrafted from 1 March 2024, excludes consortium administrators, payment institutions, securities brokers and dealers, and foreign-exchange brokers.

Article 3, item I, of Lei nº 13.506/2017 makes it an infraction to carry out operations in the National Financial System or the Brazilian Payment System in disagreement with the principles of the legal and regulatory norms that govern the activity the Banco Central do Brasil has authorized. Article 5 of Lei nº 13.506/2017 applies the penalties of public admonition, fine, bans on services and activities, disqualification of managers and withdrawal of authorization, alone or cumulatively.

Article 8 requires a supervised entity to notify the Susep, within a maximum of 5 business days from becoming aware of the event, of the occurrence of relevant incidents, detailing the extent of the damage and, where applicable, the actions under way to fully regularize the situation and those responsible and the deadlines.

Article 2 defines relevant incidents as adverse events, whether or not from malicious activity, that substantially compromise, under parameters the supervised entity sets, the confidentiality, integrity or availability of relevant data or relevant data processing or storage services. Article 6, item VII, requires the incident-handling procedures to include communication with the parties affected by the incident, above all customers.

Article 6, item VI, requires the incident-handling procedures to include sharing information on relevant incidents with the other supervised entities, in a mutually agreed format. Article 1 of Circular SUSEP nº 638 sets cybersecurity requirements for insurers, open private pension entities, capitalization companies and local reinsurers. Article 18 provides that the Circular enters into force on 1 September 2021.

Article 108 of Decreto-Lei nº 73/1966 subjects a person responsible for an infraction of the norms on insurance, co-insurance, reinsurance, retrocession and capitalization to administrative penalties applied by the supervisory body.

Article 19 provides that, to ensure freedom of expression and prevent censorship, an internet application provider may be held civilly liable for damages arising from third-party content only if, after a specific court order, it does not take the steps, within the technical limits of its service and within the period set, to make the content identified as infringing unavailable, subject to legal provisions to the contrary.

The court order must identify the infringing content clearly and specifically so as to allow its unequivocal location, on pain of nullity. Applying article 19 to infringements of copyright or related rights depends on a specific legal provision. Article 20 requires a provider that holds contact information for the user responsible for content made unavailable to tell that user the reasons for the removal, unless a legal provision or a reasoned court decision provides otherwise.

Article 21 makes a provider that makes third-party content available subsidiarily liable for the violation of privacy caused by the unauthorised disclosure of images, videos or other material containing nudity or private sexual acts if, after notice from a participant or the participant's legal representative, it fails to diligently make that content unavailable within the technical limits of its service.

Article 18 provides that an internet connection provider is not civilly liable for damages arising from content generated by third parties. On 26 June 2025 the Supremo Tribunal Federal, deciding Theme 987 in Extraordinary Appeal 1,037,396, held article 19 partially unconstitutional because its general rule gives insufficient protection to constitutional legal goods of high relevance, namely the protection of fundamental rights and democracy.

Until new legislation is enacted, the Court's thesis directs that article 19 be interpreted so that internet application providers are subject to civil liability, without prejudice to the specific provisions of electoral legislation and the acts issued by the Superior Electoral Court.

Under the thesis as clarified, a provider is jointly and severally liable under article 21 for damages from third-party content in cases of crime or unlawful acts, without prejudice to the duty to remove the content, unless reasonable doubt about unlawfulness is shown after the provider's qualified diligence analysis. The same rule applies to accounts reported as inauthentic. For crimes and civil wrongs against honour, article 19 applies, without prejudice to removal on extrajudicial notice.

Where an offensive fact already recognised by a court decision is replicated successively, all social network providers must remove publications with identical content on judicial or extrajudicial notice, without new court decisions.

Article 19 still applies to email service providers for interpersonal communications, to providers of applications whose primary purpose is closed video or voice meetings, to instant messaging providers for interpersonal communications, and to other internet application providers that have no interference in the communicative and informational flow.

The thesis presumes fault, rebuttably, where unlawful content is a paid advertisement or boost or is spread by artificial mechanisms of inorganic dissemination, allows liability without notice in those cases, and excludes liability if the provider proves it acted diligently and within a reasonable time to make the content unavailable.

A provider is responsible when it does not promote the immediate unavailability of content constituting serious crimes on a closed list, which begins with anti-democratic conduct and terrorism offences.

The Court's own account of its ruling of 17 June 2026 states that providers may be held liable when, through systemic failure, they do not adopt adequate measures to prevent or immediately remove content constituting those crimes, such as attempted coup d'état, terrorism, instigation to mutilation or suicide, racism, homophobia and crimes against women and children.

The thesis as first fixed on 26 June 2025 also required internet application providers to issue self-regulation covering a notification system, due process and annual transparency reports on extrajudicial notifications, advertisements and boosts. The thesis as first fixed also required providers operating in Brazil to establish and maintain a headquarters and a representative in the country.

The thesis as first fixed also provided that providers that operate as marketplaces answer civilly under the Consumer Defence Code. On 17 June 2026 the Court concluded its judgment of the motions for clarification and decreed the end of the period for appeals. Platforms have 60 days from the end of that judgment to implement the structural changes of the thesis relating to the duty of care.

The Court clarified that its understanding applies from the publication of the minutes of the merits judgment on 5 August 2025, except for continuing or permanent acts.

Article 63 makes accessibility mandatory on internet sites kept by companies with headquarters or commercial representation in Brazil, for use by persons with disabilities. Access to the information available must be guaranteed according to the best practices and accessibility guidelines adopted internationally. Under paragraph 1 the sites must carry the accessibility symbol in a prominent place.

Under paragraph 2 community telecenters that receive federal public funds for their operation or installation, and LAN houses, must have accessible equipment and facilities. Under paragraph 3 those telecenters and LAN houses must ensure that at least 10% of their computers have accessibility features for visually impaired persons, and at least one machine where the percentage is below one.

Article 64 requires the website accessibility of article 63 to be observed to obtain the financing referred to in article 54, item III. Article 54, item III, is the approval of financing of a project with public resources, through a tax waiver or incentive, a contract, an agreement or a similar instrument. Decree No. 9,405 of 2018 phased the duty in for the sites kept by microenterprises, small businesses and individual microentrepreneurs. The Act enters into force 180 days after its official publication.

The opening provision of article 69 places on the public authorities the duty to ensure the availability of correct and clear information about the products and services offered, by any means of communication, including the virtual environment, with the correct specification of quantity, quality, characteristics, composition and price and of any risks to the health and safety of the consumer with a disability, applying articles 30 to 41 of the Consumer Defense Code where they fit.

Under paragraph 1, online sales channels and advertisements placed in the press, on the internet, on radio and television and in other open or subscription media must offer, as far as the medium allows, the accessibility resources of article 67, at the expense of the supplier of the product or service. Paragraph 1 applies without prejudice to the observance of articles 36 to 38 of the Consumer Defense Code.

Article 67 lists those resources as closed captioning, a Libras interpreter window and audio description, among others. Under paragraph 2, suppliers must provide, on request, copies of package leaflets, prospectuses, texts or any other publicity material in an accessible format.

Under article 65, companies providing telecommunications services must guarantee full access for persons with disabilities, as specific regulation provides. Under article 67, sound and image broadcasting services must allow the use of closed captioning, a window with a Libras interpreter and audio description, among other resources.

Article 42 gives persons with disabilities the right to culture, sport, tourism and leisure on equal terms with other persons, guaranteeing them access to cultural goods in accessible format and to television programs, cinema, theater and other cultural and sporting activities in accessible format. Under paragraph 1, the refusal to offer an intellectual work in accessible format to a person with a disability is prohibited on any ground, including the protection of intellectual property rights. The Act enters into force 180 days after its official publication.

Article 62 assures persons with disabilities, on request, the receipt of bills, payment slips, receipts, statements and tax collection notices in an accessible format. The Act enters into force 180 days after its official publication.

Article 55 requires the conception and implementation of projects dealing with information and communication, including information and communication systems and technologies, that are open to the public, of public use or of private collective use, to follow the principles of universal design, with the accessibility norms as reference. Under paragraph 1, universal design is always taken as the general rule.

Under paragraph 2, where universal design demonstrably cannot be undertaken, reasonable adaptation must be adopted. Article 3 treats universal design as the conception of products, environments, programs and services to be used by all persons without need for adaptation or specific design, including assistive technology resources.

Item III of Article 6 of the Consumer Defense Code makes adequate and clear information about the different products and services, with the correct specification of quantity, characteristics, composition, quality, taxes and price, and about the risks they present, a basic right of the consumer. The sole paragraph of Article 6, added by Article 100 of the Brazilian Inclusion Law, requires that information to be accessible to persons with disabilities, as regulation provides.

Under Article 56, breaches of the consumer defense rules are subject to administrative sanctions, among them a fine, suspension of the supply of a product or service, temporary suspension of activity, cancellation of a license, interdiction and administrative intervention, without prejudice to civil and criminal sanctions.

Under Article 57 the fine is graded by the gravity of the breach, the advantage obtained and the economic condition of the supplier, and is not less than two hundred and not more than three million times the value of the Fiscal Reference Unit (Ufir), or an equivalent index that replaces it. The sole paragraph took effect with the entry into force of the Brazilian Inclusion Law.

Article 7 makes accessibility mandatory on the electronic sites kept by a microenterprise, a small business or an individual microentrepreneur. It allows the accessibility to be achieved gradually, within twelve months of the Decree's publication for small businesses and eighteen months for microenterprises and individual microentrepreneurs.

Article 1 treats as microenterprises and small businesses those that meet the requirements of Article 3 of Lei Complementar nº 123 de 2006, including the individual microentrepreneur. For the reasonable adaptations the Decree provides for, Article 1, paragraph 2, treats as not imposing a disproportionate burden those whose cost is capped at 2.5% of the previous financial year's gross revenue for an individual microentrepreneur, 3.5% for a microenterprise and 4.5% for a small business.

Article 1, paragraph 3, requires the adaptations needed to comply with the Decree to follow the technical norms provided in legislation and the norms of the Associação Brasileira de Normas Técnicas (ABNT). Article 8 makes inspection of compliance with the Decree advisory in nature, and requires a double advisory visit before an infringement notice is issued. The Decree regulates Article 122 of the Brazilian Inclusion Law and enters into force on the date of its publication.

Under paragraph 1 of article 68, in calls for the purchase of books, including for supplying or updating the collections of libraries at every level and kind of education and of public libraries, the public authorities must adopt clauses that bar the participation of publishers that do not also offer their production in accessible formats.

Paragraph 2 treats as accessible formats the digital files that screen-reading software, or other assistive technologies that may replace it, can recognize and access, allowing reading with a synthesized voice, enlargement of characters, different contrasts and printing in Braille. The opening provision of article 68 requires the public authorities to adopt mechanisms that encourage the production, publishing, dissemination, distribution and sale of books in accessible formats. The Act enters into force 180 days after its official publication.

Lei nº 15.211/2025 applies to any information-technology product or service directed at children or adolescents in Brazil, or likely to be accessed by them, regardless of the provider's location, development, manufacture, offer, marketing, or operation. Article 5 requires such a product or service to observe duties of prevention, protection, information, and security, adopting the child's or adolescent's best interest and integral protection as the guiding standard.

Article 11 lets the public authority act as regulator, certifier, or promoter of age-verification technical solutions.

Article 12 requires app-store and terminal operating-system providers to take proportionate, auditable, and technically secure measures to assess users' age or age range, to let parents or legal guardians configure voluntary parental-supervision mechanisms, and to make an age signal available to internet application providers through a privacy-by-design Application Programming Interface, limited to this law's purposes.

Article 14 requires the product or service provider itself, independently of the measures app stores or operating systems adopt, to implement its own mechanisms to prevent children and adolescents from accessing content unsuited to their age range. Articles 16 to 18 require parental-supervision tools, and article 18, § 2º prohibits designing, modifying, or manipulating an interface to undermine a user's autonomy or decision-making where doing so weakens those supervision tools or safeguards.

Article 35 authorizes an advertência, a simple fine of up to 10% of the economic group's revenue in Brazil in its last fiscal year, or, absent revenue, a per-registered-user fine, capped in total at R$50,000,000.00 per infraction, temporary suspension, or prohibition of activity, enforced by the Agência Nacional de Proteção de Dados (ANPD), which Decreto nº 12.622/2025 designates as the autonomous administrative authority for the protection of children and adolescents in digital environments.

Article 36-A, added by Lei nº 15.504, de 15 de setembro de 2026, directs the money from fines imposed under this law, for 5 years, to the Fundo Nacional para a Criança e o Adolescente, to be used in policies and projects to protect children and adolescents. The law's article 41-A entry-into-force date was set at six months after publication by Medida Provisória nº 1.319/2025 and then fixed at 17 March 2026 by Lei nº 15.352/2026, and the law has bound covered providers from that date.

Article 46, I, a) permits, without offending copyright, reproducing a news item or informative article published in a daily or periodical, in the daily or periodical press, naming the author if the item was signed and the publication it was transcribed from.

Article 46, III separately permits quoting passages of any work, in a book, newspaper, magazine, or any other communication medium, for the purposes of study, criticism, or controversy, to the extent justified for the purpose to be achieved, naming the author and the origin of the work.

Neither provision carries a headline-length or short-extract cap distinct from these tests, and no reported Brazilian decision applies either provision to a systematic news aggregator rather than a periodical reproducing another periodical's item or an individual quoting a published work. Neighbouring rights under the Act, covering performers, phonogram producers, and broadcasting organizations, do not extend to a print or online news publisher's own reporting.