Privacy Map

Brazil. Sectoral privacy. Law

Marco CivilBrazilian Civil Rights Framework for the Internet, Law No. 12,965/2014 (Marco Civil da Internet)

In force
Partly verifiedMedium confidence. Penalty and STF ruling from general knowledge.

§1Summary

Synopsis

Establishes principles, rights and duties for internet use in Brazil, including privacy of communications, net neutrality, intermediary liability and mandatory retention of connection and application access logs.

Key themes
  • internet rights
  • log retention
  • intermediary liability
  • net neutrality
  • confidentiality of communications
Unique features

Application providers operating as a business must retain access logs for six months; Brazilian law applies when any collection act occurs in Brazil.

SaaS relevance

SaaS 'application providers' offering services in Brazil must keep access logs, protect communications and respond to court orders.

§2Obligations

Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
Brazilian law applies to data collected in Brazil
Maximum penalty
Up to 10% of Brazilian group revenue; suspension or prohibition of activities

§3Dates

Key dates
  • Adopted
  • In force
  • Regulated by Decree 8,771/2016; STF 2025 ruling expanded platform liability under art. 19

§4Text and authority

Text
Authority
Courts; ANPD/consumer authorities for overlapping matters

§5Where it applies

Domestic law of
Brazil

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. Penalty and STF ruling from general knowledge.