Cybersecurity regulation in Brazil (2026)

CMN Resolution No. 5,274/2025 and BCB Resolution No. 538/2025 updated cybersecurity policy and cloud/data-processing contracting requirements for BCB-regulated institutions, modernizing the 2018 framework. It raises baseline security and outsourcing obligations across Brazil's financial sector.

Brazil enacted a new National Cybersecurity Strategy (E-Ciber) with roughly 40 strategic actions, replacing the 2020 strategy and implementing the PNCiber. It defines timelines and governance to be detailed in a forthcoming National Cybersecurity Plan (P-Ciber).

The STF ruled Article 19 of the Marco Civil da Internet partially unconstitutional, allowing platforms to be held civilly liable for certain unlawful content (hate speech, terrorism, child sexual abuse material, serious disinformation) without a prior court order. It imposes a stricter duty of care on online platforms.

The data protection authority operationalized LGPD Article 48, requiring controllers to notify ANPD and affected individuals within three business days when a breach poses relevant risk or harm, and to keep breach records for five years. It clarified long-uncertain incident-reporting duties.

The decree created Brazil's overarching National Cybersecurity Policy with seven principles and eleven objectives, plus the National Cybersecurity Committee (CNCiber) to steer implementation. It set the foundational governance framework guiding the country's later cyber strategy.

An exposed database revealed personal data of more than 220 million Brazilians and tens of millions of companies, including CPF numbers, addresses, income and credit scores — the largest leak in the country's history. It intensified pressure for stronger data-security enforcement and incident regulation.

Coordinated by the Institutional Security Cabinet (GSI), Brazil's first National Cybersecurity Strategy set federal cyber-defense priorities and made federal agencies responsible for implementing its actions. It marked the first structured national approach to cybersecurity governance.

Brazil's omnibus data-protection law imposed security, breach-notification and accountability duties on public and private data processors and created the basis for the ANPD. It anchors most data-security obligations applicable in Brazil today.

The National Monetary Council issued Brazil's first binding sector cybersecurity rules, mandating cyber-security policies, incident response and strict cloud/outsourcing requirements for Central Bank-regulated institutions. It became the template for Brazil's financial-sector cyber regulation.

The 'Internet Bill of Rights' set principles for internet use including privacy, data protection, net neutrality and data-retention/security duties for connection and application providers. It established core obligations for handling and safeguarding user data online.

Prompted by the leak of a celebrity's private photos, this law amended the Penal Code to criminalize unauthorized access to computer devices and related cyber offenses. It was Brazil's first dedicated cybercrime statute, laying the criminal-law foundation for cybersecurity.