According to the guidelines of Act No. 77, of 5 January 2021, when requesting the homologation of the product for telecommunications with ANATEL (Agência Nacional de Telecomunicações), the applicant must present a declaration expressing which cybersecurity requirements the equipment and its supplier meet. There are concerns from the industry regarding the scope and definitions of this Act, including to which products the regulation applies and the lack of reliance on international standards. Among other provisions, it is reported that the Act vaguely mandates the guarantee of appropriate encryption methods.

The Brazilian Government charges a flat 60% duty for all express shipments imported through the Simplified Customs Clearance process. Moreover, Brazilian Customs have established express services maximum per-shipment value limits of USD 3,000 for imports, according to Art. 1 of Ministerial Ordinance 156/1999. This is reported to affect particularly online sales.

The Interpretative Act No. 7 of August 2014, issued by the Brazilian Federal Revenue Secretariat (Receita Federal do Brasil – RFB), deals with the taxation of cross-border payments for data centres outside Brazil. It applies to all amounts paid, credited, delivered or remitted by individuals or legal entities resident or domiciled in Brazil to companies headquartered abroad that are identified as offshore data centres.
According to the Act, when the Brazilian source of payment hires offshore data centres for the use of infrastructure for storage and remote high-performance data processing systems, the transactions are deemed to be typical provision of services and cannot be characterised as rental of movable assets for tax purposes. The consequence of this interpretation is that the use of offshore data centres triggers the following federal taxes in Brazil:
- Withholding income tax (Imposto sobre a Renda Retido na Fonte – IRFF) at the rate of 15% or 25% whenever the recipient is located in a tax haven jurisdiction;
- Cide-royalties contribution (Contribuição de Intervenção no Domínio Econômico destinada a financiar o Programa de Estímulo à Interação Universidade-Empresa para o Apoio à Inovação – Cide-royalties), at the rate of 10%;
- PIS-importation contribution (Contribuição para o PIS/Pasep-Importação) at the rate of 1.65%;
- Cofins-importation contribution (Contribuição para o Cofins-Importação) at the rate of 7.6%; and
- IOF (Imposto sobre Operações de Câmbio), which is the financial tax levied on the foreign exchange transaction, at the rate of 0.38%.

Brazil does not implement any de minimis threshold, which is the minimum value of goods below which customs do not charge duties.

Foreign companies can register a domain ".br" after the conclusion of a special registration, which requires a local legal representative and a declaration that the company will establish activities in Brazil within 12 months from the registration, according to Art. 6 of the Resolution of the Internet Steering Committee 2008/008/P.

Online pharmacies must have "com.br" or "far.br" domains. Moreover, according to Art. 53.2 of Resolution of the Director's Board of the National Agency for Health Surveillance 44/2009, Internet pharmacies are permitted in Brazil only if the Internet pharmacy is the website component of a licensed Brazilian brick-and-mortar pharmacy,

According to Art. 17 of Criminal Organisation Law, concessionaires of fixed or mobile telephony must keep, for a period of five years, at the disposal of the Police Chief or the Public Prosecutor, records of identification of the terminal numbers of origin and destination of international, long distance and local phone calls.

Art. 41 of the General Personal Data Protection Law stipulates that the controller must designate a data protection officer responsible for overseeing the processing of personal data. Resolution CD/ANPD No. 18/2024 subsequently approved the regulation governing the role of the data protection officer in relation to such processing.

The Civil Rights Framework for the Internet law establishes a safe harbour regime for intermediaries for copyright infringements. Art. 18 states that “the Internet connection provider shall not be subject to civil liability for content generated by third party”. Art. 19, which addresses Internet application providers (excluding connection providers), states that “in order to ensure freedom of expression and to prevent censorship, an Internet application provider shall only be subject to civil liability for damages caused by virtue of content generated by third parties if, after specific court order, it does not take action, according to the framework and technical limits of its services and within the time-frame ordered, to make the infringing content unavailable.”
It is reported that, in 2025, the Supreme Court found aspects of Art. 19 to be unconstitutional. Consequently, responsibility now lies with the National Congress to draft comprehensive and technically robust legislation.

The Civil Rights Framework for the Internet law establishes a safe harbour regime for intermediaries beyond copyright infringements. Art. 18 states that “the Internet connection provider shall not be subject to civil liability for content generated by third party”. Art. 19, which addresses Internet application providers (excluding connection providers), states that “in order to ensure freedom of expression and to prevent censorship, an Internet application provider shall only be subject to civil liability for damages caused by virtue of content generated by third parties if, after specific court order, it does not take action, according to the framework and technical limits of its services and within the time-frame ordered, to make the infringing content unavailable.”
It is reported that, in 2025, the Supreme Court found aspects of Art. 19 to be unconstitutional. Consequently, responsibility now lies with the National Congress to draft comprehensive and technically robust legislation.

According to Art. 1 of Law 10.703, it is the responsibility of prepaid telecommunications service providers operating in the national territory to have an updated register of users. The registration, in addition to the full name and address, must contain, in the case of natural persons, the identity card number or registration number in the registry of the Ministry of Finance.

In February 2025, the Supreme Court ordered the blocking of the social media platform Rumble, citing the platform’s failure to appoint a local representative and its refusal to restrict certain accounts.

Brazil generally prohibits the importation of used consumer goods, including information and communications technology (ICT) products. However, Ordinance No. 23/2011 of the Secretariat of Foreign Trade (SECEX) provides a list of exceptions, covering more than 25 categories of used goods that may be authorised for importation under specific conditions.

According to Arts. 41 and No. 42 of Ordinance 23 of July 2011 of the Secretary of Foreign Trade, the importation of used machinery, equipment, devices, instruments, moulds, and containers are prohibited unless these used goods are not produced in the country or are irreplaceable by other similar products manufactured in the country.

Brazil has joined two agreements with binding commitments to open data transfers across borders: the Chile-Brazil Bilateral Trade Agreement (Art. 10.12), and the Mercosur E-commerce Agreement (Art. 7.2).