Brazil Cybersecurity ANPD CGI.br 2026

Brazil’s cybersecurity architecture is more federated than the equivalent in some other major economies. There is no single cybersecurity supervisor; instead, responsibility is distributed across the ANPD (data protection), the CGI.br (internet governance), CTIR.gov (the federal cyber incident response team), the Federal Police (criminal investigation), and the sector regulators (BCB for finance, ANS for health insurance, ANATEL for telecom). In 2024-2026 this federation has tightened coordination, but the practical compliance work for enterprises still spans multiple regulators.

I want to walk through the architecture and what engineering teams should be doing in 2026.

Brazil cybersecurity ANPD

The federal coordination#

CTIR.gov is the federal government’s cyber incident response coordination team, part of the GSI (Institutional Security Office). It coordinates with sector CSIRTs and with international peers (FIRST, ENISA, US-CERT).

E-Ciber (the National Cybersecurity Policy, refreshed in 2023) is the strategic framework. It identifies critical infrastructure sectors, sets capability-building priorities, and frames the public-private partnership for cybersecurity.

CGI.br (the Internet Steering Committee) is the multi-stakeholder body governing internet infrastructure questions. CGI.br operates CERT.br (the national CERT) and NIC.br (the registry for .br domains plus various technical operations including DNS).

ANPD has cybersecurity-relevant jurisdiction through LGPD’s data-breach notification framework.

Sector regulators — BCB for banking, SUSEP for insurance, ANS for health insurance, ANATEL for telecom, CVM for capital markets — each have their own cybersecurity expectations for regulated entities.

The federation produces a workable but multi-pronged compliance posture for enterprises in regulated sectors.

LGPD breach notification#

LGPD requires notification of personal data breaches to the ANPD and (for incidents posing significant risk to data subjects) to affected individuals. The 2025 LGPD amendments specified a 48-hour notification window for serious breaches — comparable to GDPR’s 72 hours.

The practical operational requirements:

Detection capability — the controller must be able to detect a breach. Reasonable detection mechanisms must be in place.
Severity assessment — not every incident requires notification; the 48-hour timeline applies to incidents with significant risk to data subjects.
Documentation — even non-notifiable incidents must be recorded internally.
Notification content — the ANPD has issued templates and specific content requirements.
Mitigation measures — the notification must include the measures taken to mitigate impact.

The ANPD’s enforcement of breach notification has been one of its early priorities, and several administrative actions have specifically cited late notification as a primary infraction.

Critical Infrastructure protection#

Brazil identifies a set of critical infrastructure sectors with heightened cybersecurity expectations:

Energy (electricity, oil & gas)
Finance
Telecommunications
Transportation (aviation, rail, ports)
Water and sanitation
Health
Government services
Defense

Sector regulators have specific cybersecurity expectations for entities in these sectors. The trajectory in 2025-2026 has been more prescriptive obligation, particularly post-LGPD 2.0.

Sector-specific obligations#

BCB CMN Resolution 4893 / 4658 framework for banks and payment institutions requires comprehensive cybersecurity programs — cyber policy approved by the board, technology risk assessments, vendor risk management, incident response, and specific reporting timelines for serious incidents.

SUSEP requirements for insurance companies mirror the BCB framework with insurance-specific adaptations.

ANS for health insurance with health-data-specific obligations.

ANATEL for telecommunications — particularly for the larger operators, with specific obligations under various regulations.

For enterprises in multiple regulated sectors (e.g., a fintech-insurance combination) the compliance work must satisfy multiple regulators.

The federal government cybersecurity posture#

The federal government itself has substantial cybersecurity infrastructure. The TI Maior strategy, the various CGU (Comptroller General) initiatives, and the broader digital-government strategy have produced operational cybersecurity capabilities. The Ministry of Justice’s cybersecurity coordination, the Federal Police’s specialized cybercrime units, and the increasingly active intelligence community presence on cyber matters all contribute.

The 2024 Lapsus-style intrusion attempts targeting Brazilian government and critical infrastructure produced a renewed focus on coordination capability, which has shown improvement in 2025-2026.

Practical engineering checklist#

For an enterprise operating in Brazil in 2026:

SOC and incident response capability with the maturity to meet sector-specific notification timelines.
LGPD breach response runbook with the 48-hour ANPD path automated.
Sector-regulator-specific compliance program for regulated entities.
Vendor risk management with documented assessments.
Critical Infrastructure mapping if applicable.
Information sharing posture — participation in sector ISACs and CGI.br working groups.
Ransomware readiness — backup architecture, restoration testing, payment policy, communications planning.
Tabletop exercises with the cross-functional team.

The international context#

Brazil participates actively in international cybersecurity coordination:

OAS (Organization of American States) cyber initiatives.
MERCOSUL cybersecurity coordination.
FIRST and other international CERT coordination.
Bilateral arrangements with US, EU, UK, and increasingly with India and Japan.

For foreign multinationals operating in Brazil, the practical implication is that incident response can involve coordination with international peers under specific arrangements.

What’s coming in 2026 and 2027#

Three things to watch:

The federal cybersecurity reform legislation in late-stage drafting may consolidate some of the federated structure into a more central coordinator.

ANPD enforcement is expected to continue tightening, particularly on cybersecurity-related personal data breaches.

Sector regulators are increasingly cross-referencing each other’s frameworks, producing a slowly converging set of expectations.

Where pdpspectra fits#

We run cybersecurity engineering and compliance programs for clients operating in Brazil and across Latin America. Our work spans incident response design, SOC implementation, sector-specific regulatory compliance, and the platform engineering that makes the cybersecurity posture operationally sustainable.

Brazil’s cybersecurity expectations are tightening. Talk to our team about your program.