Cybersecurity law & regulation in Brazil (2026)
Cybersecurity in Brazil: sectoral rules.
Brazil does not yet have a single comprehensive, NIS2-style cybersecurity law. Instead it relies on a governance framework set by presidential decree (PNCiber 2023 and the updated E-Ciber Strategy of August 2025), combined with sector-specific cybersecurity rules for banking (BCB Resolution 538/2025 and CMN Resolution 5.274/2025) and telecoms (ANATEL Resolutions 740/2020 and 780/2025), plus the LGPD's personal-data breach-notification duties enforced by the ANPD. A dedicated Cybersecurity Legal Framework bill (PL 4.752/2025) that would create a National Cybersecurity Authority was introduced in the Senate in September 2025 but has not been enacted.
Legal framework
Patchwork of sectoral rules (BCB/CMN for finance, ANATEL for telecoms) plus LGPD Law No. 13.709/2018 with ANPD Resolution CD/ANPD No. 15/2024 on security incidents, coordinated under the National Cybersecurity Policy — PNCiber (Decree No. 11.856/2023) and the National Cybersecurity Strategy — E-Ciber (Decree No. 12.573/2025). A comprehensive Cybersecurity Legal Framework (Senate Bill PL 4.752/2025) is pending.
Key points: cybersecurity in Brazil
National policy by decree, not statute
The National Cybersecurity Policy (PNCiber) was created by Decree No. 11.856 of 26 December 2023, establishing the National Cybersecurity Committee (CNCiber) and setting principles/objectives — but it is an executive-branch instrument, not an omnibus cybersecurity law with binding obligations on private operators.
Updated National Cybersecurity Strategy (E-Ciber) 2025
Decree No. 12.573 of 4 August 2025 launched the updated E-Ciber strategy, structured around citizen protection, resilience of critical infrastructure, public-private cooperation and national sovereignty, with ~40 strategic actions to be detailed in a forthcoming National Cybersecurity Plan (P-Ciber).
Comprehensive law still only proposed
Bill PL 4.752/2025, introduced in the Federal Senate on 24 September 2025, would create a Legal Framework for Cybersecurity and a National Cybersecurity Authority empowered to set standards, audit and publish compliance lists; as of 2026 it remains under legislative review and is not in force.
Financial sector — BCB/CMN cyber rules
CMN Resolution No. 5.274/2025 and BCB Resolution No. 538/2025 (published 18 December 2025, compliance by 1 March 2026) strengthen cybersecurity and cloud-services rules for institutions regulated by the Central Bank of Brazil, updating the earlier CMN Resolution 4.893/2021 and covering the National Financial System and the Brazilian Payment System (including PIX).
Telecoms sector — ANATEL cyber rules
ANATEL Resolution No. 740/2020 sets cybersecurity obligations for all providers of telecommunications services of collective interest, and Resolution No. 780/2025 extends robust cybersecurity requirements to data centres integrated with telecommunications networks.
Breach notification under the LGPD
Under the LGPD (Law 13.709/2018) and ANPD Resolution CD/ANPD No. 15 of 24 April 2024, controllers must notify the ANPD and affected data subjects of security incidents involving personal data that create relevant risk within 3 business days (6 for small agents), submitted through the ANPD's online platform, with incident records kept for at least 5 years.
Timeline of decisions
- GuidanceCentral Bank tightens cyber and cloud rules for financial institutions
CMN Resolution No. 5,274/2025 and BCB Resolution No. 538/2025 updated cybersecurity policy and cloud/data-processing contracting requirements for BCB-regulated institutions, modernizing the 2018 framework. It raises baseline security and outsourcing obligations across Brazil's financial sector.
Baker McKenzie / Global Compliance News
- LawDecree 12,573/2025 launches E-Ciber National Cybersecurity Strategy
Brazil enacted a new National Cybersecurity Strategy (E-Ciber) with roughly 40 strategic actions, replacing the 2020 strategy and implementing the PNCiber. It defines timelines and governance to be detailed in a forthcoming National Cybersecurity Plan (P-Ciber).
Mattos Filho
- Law · officialDecree 11,856/2023 establishes National Cybersecurity Policy (PNCiber)
The decree created Brazil's overarching National Cybersecurity Policy with seven principles and eleven objectives, plus the National Cybersecurity Committee (CNCiber) to steer implementation. It set the foundational governance framework guiding the country's later cyber strategy.
Presidência da República (Planalto)
- IncidentMega data leak exposes ~223 million CPF records
An exposed database revealed personal data of more than 220 million Brazilians and tens of millions of companies, including CPF numbers, addresses, income and credit scores, the largest leak in the country's history. It intensified pressure for stronger data-security enforcement and incident regulation.
Cybernews
- Law · officialDecree 10,222/2020 enacts first E-Ciber strategy (2020-2023)
Coordinated by the Institutional Security Cabinet (GSI), Brazil's first National Cybersecurity Strategy set federal cyber-defense priorities and made federal agencies responsible for implementing its actions. It marked the first structured national approach to cybersecurity governance.
Presidência da República (Planalto)
- Guidance · officialCMN Resolution 4,658/2018: cybersecurity rules for financial institutions
The National Monetary Council issued Brazil's first binding sector cybersecurity rules, mandating cyber-security policies, incident response and strict cloud/outsourcing requirements for Central Bank-regulated institutions. It became the template for Brazil's financial-sector cyber regulation.
Banco Central do Brasil
- Law · officialCarolina Dieckmann Law criminalizes hacking (Law 12.737/2012)
Prompted by the leak of a celebrity's private photos, this law amended the Penal Code to criminalize unauthorized access to computer devices and related cyber offenses. It was Brazil's first dedicated cybercrime statute, laying the criminal-law foundation for cybersecurity.
Presidência da República (Planalto)
Sources
- planalto.gov.br/ccivil_03/_ato2023-2026/2023/decreto/d11856.htm
- digitalpolicyalert.org/change/8056
- digitalpolicyalert.org/event/32512-decree-no-12573-establishing-the-national-cybersecurity-s
- mattosfilho.com.br/en/unico/cybersecurity-strategy-decree/
- dig.watch/updates/__trashed-7
- iapp.org/news/a/brazil-set-to-adopt-cybersecurity-legal-framework
- trenchrossi.com/en/legal-alerts/bcb-and-cmn-establish-additional-cyber-security-requi
- connectontech.bakermckenzie.com/brazil-bcb-and-cmn-establish-additional-cyber-security-requirements/
- iclg.com/practice-areas/telecoms-media-and-internet-laws-and-regulations/brazi
- resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/latin-america/brazil/topi
- iapp.org/news/a/anpd-s-regulation-on-security-incidents
- dlapiperdataprotection.com/index.html?t=breach-notification&c=BR
Next for Brazil: Starting a BusinessModerate
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 15 Aug 2026. Methodology & how to cite · State of Technology Regulation 2026