Art. 12 of Resolution CMN No. 4.893 and Art. 12 of Resolution BCB No. 85 state that institutions authorised to operate by the Central Bank of Brazil (Banco Central do Brasil, BCB) may contract cloud and data processing services in Brazil or abroad as long as they adopt corporate governance practices proportionate to the service hired and the risks to which they are exposed to, and verify the capability of the potential service to ensure compliance with the current legislation, institution's access to data, the confidentiality and integrity of data, adherence to certification patterns required by the institution, access to auditing reports, provision of information and management resources appropriate to the monitoring of services provided, identification of the institution's customer data and quality of access controls aimed at protecting customers data. In addition, Art. 15 of both Resolutions establishes that the companies should notify BCB of the countries where financial data is processed. Also, Art. 16 of both Resolutions provides that the contracting of data processing, data storage and cloud computing relevant services provided abroad must fulfil the following requisites:
- The existence of an agreement for the exchange of information between the BCB and the supervisory authorities of the countries where the services may be provided;
- The contracting institution must ensure that the provision of the services does not cause damage to its own functioning, neither do they deter the action of the BCB;
- The contracting institution must define, previously to the contracting, the countries and the regions in each country where the services can be provided and the data can be stored, processed and managed;
- The contracting institution must anticipate alternatives for business continuity, either in the case of the impossibility of continuing the contract or terminating it.
The BCB's prior approval must be obtained if the institution retains a cloud service provider in countries where there is no agreement to exchange information between the BCB and the competent authorities. The institutions must request such approval from the BCB at least 60 days before retaining the cloud services in question.

Brazil has joined one agreement with binding commitments to open data transfers across borders: the Chile-Brazil Bilateral Trade Agreement (Art. 10.12).

The Personal Data Protection Law provides a framework for comprehensive data protection in Brazil. It applies to the treatment of personal data, including through digital means, by natural or juridical persons of a public or private nature. The law applies regardless of the country of origin of the person and the country where data is located provided that: data treatment is made in the national territory; or data treatment activities aims at the supply of goods or services or data treatment of individuals located in the national territory; or data has been collected in the national territory.

According to Art. 17 of Criminal Organisation Law, concessionaires of fixed or mobile telephony must keep, for a period of five years, at the disposal of the Police Chief or the Public Prosecutor, records of identification of the terminal numbers of origin and destination of international, long distance and local phone calls.

Art. 13 of the Civil Rights Framework for the Internet states that connection logs of Internet service providers (ISPs) should be retained for a minimum period of one year. The police, administrative authorities, or the Public Prosecutor's Office may request in a precautionary manner that the connection logs be kept for a longer period. Authorities have a period of 60 days, counting from the time of the request, to obtain a court order to access the information.

According to Art. 15 of the Civil Rights Framework for the Internet, internet application providers that are constituted as a legal entity and that carry out this activity in an organised manner professionally and with economic purposes must retain the respective records of access to the Internet applications for a period of six months. Internet applications are defined in Art. 5 (VII) as a set of functionalities that can be accessed through a terminal connected to the Internet.

Under Art. 120 of ANATEL Resolution No. 777/2025, telecommunications service providers must keep service-related data available to ANATEL for regulatory supervision. This includes fiscal documents and subscriber registration data for a minimum period of five years for all telecommunications services; data on calls made and received, including date, time, duration and value of the call, for five years in services that allow telephone traffic; billing data for five years where applicable; and internet connection records for one year in services that allow internet connection.
Under Art. 2, the Resolution repealed Resolution No. 738/2020, which implemented similar data retention requirements.

Art. 41 of the General Personal Data Protection Law stipulates that the controller must designate a data protection officer responsible for overseeing the processing of personal data. Resolution CD/ANPD No. 18/2024 subsequently approved the regulation governing the role of the data protection officer in relation to such processing.

The Civil Rights Framework for the Internet law establishes a safe harbour regime for intermediaries for copyright infringements. Art. 18 states that “the Internet connection provider shall not be subject to civil liability for content generated by third party”. Art. 19, which addresses Internet application providers (excluding connection providers), states that “in order to ensure freedom of expression and to prevent censorship, an Internet application provider shall only be subject to civil liability for damages caused by virtue of content generated by third parties if, after specific court order, it does not take action, according to the framework and technical limits of its services and within the time-frame ordered, to make the infringing content unavailable.”
It is reported that, in 2025, the Supreme Court found aspects of Art. 19 to be unconstitutional. Consequently, responsibility now lies with the National Congress to draft comprehensive and technically robust legislation.

The Civil Rights Framework for the Internet law establishes a safe harbour regime for intermediaries beyond copyright infringements. Art. 18 states that “the Internet connection provider shall not be subject to civil liability for content generated by third party”. Art. 19, which addresses Internet application providers (excluding connection providers), states that “in order to ensure freedom of expression and to prevent censorship, an Internet application provider shall only be subject to civil liability for damages caused by virtue of content generated by third parties if, after specific court order, it does not take action, according to the framework and technical limits of its services and within the time-frame ordered, to make the infringing content unavailable.”
It is reported that, in 2025, the Supreme Court found aspects of Art. 19 to be unconstitutional. Consequently, responsibility now lies with the National Congress to draft comprehensive and technically robust legislation.

According to Art. 1 of Law 10.703, it is the responsibility of prepaid telecommunications service providers operating in the national territory to have an updated register of users. The registration, in addition to the full name and address, must contain, in the case of natural persons, the identity card number or registration number in the registry of the Ministry of Finance.

According to Art. 26 of Law No. 14,133 of 2021, a margin of preference may be established for national manufactured goods and national services that comply with Brazilian technical standards. The normal margin may be up to 10% over the price of non-qualifying goods and services, while national goods and services resulting from development and technological innovation in Brazil may receive an additional margin, subject to a maximum combined preference of 20%. The preference may be extended to goods and services originating in Mercosur States where reciprocity is established by an approved and ratified international agreement. Decree No. 11,890 of 2024 regulates the mechanism, and CICS resolutions specify the products and applicable normal and additional margins.

It is reported that although Brazil permits Brazilian-owned entities to acquire the exclusive right to operate a satellite and its associated frequencies from specific positions, foreign-licensed satellite operators may obtain only a non-exclusive right (a landing right) to provide service in Brazilian territory. The National Telecommunications Agency (ANATEL) grants these landing rights for a fixed term of no longer than 15 years, after which the operator must reacquire the landing rights in order to continue providing services. Foreign operators are also required to pay higher annual landing fees than Brazilian firms.

According to Art. 60 of Law No. 14,133 of 2021, where the primary tie-breaking criteria do not resolve a tie, preference is given successively to goods and services produced or supplied by enterprises established in the relevant State or Federal District, Brazilian enterprises, enterprises investing in research and technological development in Brazil, and enterprises demonstrating climate-change mitigation practices.

Brazil has not appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.