--- title: "Brazil — Sectoral Watch | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/brazil/sectoral-watch/ source_html: /jurisdictions/brazil/sectoral-watch/index.html description: "Brazil — Sectoral Watch: sectoral_watch Sectoral Watch 7 sub-modules 5 claims Amber ▾ # Financial and health overlays are documented and active; telecoms/ePrivacy, education and insurance sub-areas lack dedica" generated_at: 2026-10-25T04:46:50Z content_sha256: fd3859ac520d049e328b3b13744dced35ea2426b9258469e38b991291a4988d5 generator: "fe-fleet/md-twin@1.0" --- # Brazil — Sectoral Watch | Data Protection Monitor ### D6Sectoral Watch7 sub-modules5 claimsAmber▾# Financial and health overlays are documented and active; telecoms/ePrivacy, education and insurance sub-areas lack dedicated sectoral DP instruments in the sources reviewed. Primary framework LGPD (general) plus BACEN/CMN Open Finance regulation and FEBRABAN self-regulation (financial sector) Supervisory authority [ANPD (general); Banco Central do Brasil (BACEN) for financial-sector conduct](https://www.bcb.gov.br/) Traffic-light rationale — Amber Financial and health overlays are documented and active; telecoms/ePrivacy, education and insurance sub-areas lack dedicated sectoral DP instruments in the sources reviewed. #### Sub-modules (7) #### Financial Sector OverlayGreen BACEN and the Monetary Council's Open Finance regulation establishes consent as the sole legal ground for data transfers within open banking; FEBRABAN's CARB Standard 21/2022 reiterates and supplements LGPD requirements for banks. Claims (2): - The Central Bank and Monetary Council's open banking regulation establishes consent as the unique legal ground for data transfers within the scope of open banking, excluding sensitive data, credit scores/ratings and login/access credentials from the transferable dataset. - FEBRABAN's CARB Standard 21/2022 reiterates and adds to LGPD requirements, prompting financial institutions toward international standards and better data-protection governance. #### Health Sector OverlayAmber ANPD sanctioned the Instituto de Assistência Médica ao Servidor Público Estadual (IAMSPE) for failing to safeguard public employees' health data and for an untimely Article 48 breach notification. Claims (1): - ANPD determined that the government health system IAMSPE violated the LGPD by failing to safeguard public employees' personal health data and by not producing a data-breach notification within a reasonable period. #### Telecoms And EprivacyRed No dedicated telecoms/ePrivacy-specific data-protection overlay (comparable to the EU ePrivacy Directive) was identified for Brazil in this research pass; cookie-specific guidance exists as ANPD soft-law rather than a distinct statute. Claims (1): - No distinct telecoms/ePrivacy statute analogous to the EU ePrivacy Directive was located for Brazil; ANPD has issued a Guide on Cookies and Data Protection as soft-law guidance rather than binding sector legislation. #### Employment DataAmber Employment-related sensitive health data has been subject to ANPD enforcement in the public sector (IAMSPE case involving public employees' health data), but no dedicated private-sector employment-data statute was identified. Claims (1): - ANPD determined that the government health system IAMSPE violated the LGPD by failing to safeguard public employees' personal health data and by not producing a data-breach notification within a reasonable period. #### Credit And ScoringAmber The 'protection of credit' legal basis (Art. 7 X) underpins credit-bureau and scoring activity; Brazilian courts have restricted processing of data such as voter registration number, mother's name, lifestyle, social class, schooling, marginal propensity to consume and georeferencing for credit-protection purposes as not necessary. Claims (1): - Brazilian courts have restricted the processing of data such as voter registration number, mother's name, lifestyle, social class, schooling, marginal propensity to consume and georeferencing for credit-protection purposes as not necessary. #### EducationRed No education-sector-specific data-protection instrument was identified in this research pass beyond general LGPD applicability and DPIA guidance touching on children's data in digital products. #### InsuranceRed No insurance-sector-specific data-protection instrument was identified in this research pass beyond general LGPD applicability. Category narrative 92 words Financial-sector data flows are shaped by BACEN/Monetary Council open-banking (Open Finance) rules layered atop the LGPD, plus bank self-regulation (FEBRABAN's CARB Standard 21/2022). Health-sector enforcement so far centres on ANPD sanctions against a public health-insurance entity for failing to safeguard employees' health data and for a late Article 48 breach notification. Credit/scoring processing is governed by a bespoke 'protection of credit' legal basis, with courts restricting non-necessary data (e.g., voter registration, marginal propensity to consume) in credit-protection scoring. No comprehensive telecoms/ePrivacy-specific overlay, education-sector, or insurance-sector regime was identified in this research pass. Evidence 5 Sources and claims (5) - Confirmed[OneTrust DataGuidance](https://www.dataguidance.com/opinion/brazil-new-open-banking-rules) — The Central Bank and Monetary Council's open banking regulation establishes consent as the unique legal ground for data transfers within the scope of open banking, excluding sensitive data, credit scores/ratings and login/access credentials from the transferable dataset.observed 2026-08-03 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/opinion/brazil-new-data-protection-regulations-banks) — FEBRABAN's CARB Standard 21/2022 reiterates and adds to LGPD requirements, prompting financial institutions toward international standards and better data-protection governance.observed 2026-08-03 - Confirmed[IAPP](https://iapp.org/news/a/brazils-andp-finds-health-care-system-failed-to-protect-employees-data/) — ANPD determined that the government health system IAMSPE violated the LGPD by failing to safeguard public employees' personal health data and by not producing a data-breach notification within a reasonable period.observed 2026-08-03 - Uncertain[EUR-Lex](https://eur-lex.europa.eu/eli/dec_impl/2026/179/oj/eng) — No distinct telecoms/ePrivacy statute analogous to the EU ePrivacy Directive was located for Brazil; ANPD has issued a Guide on Cookies and Data Protection as soft-law guidance rather than binding sector legislation.observed 2026-08-03 - Probable[EUR-Lex](https://eur-lex.europa.eu/eli/dec_impl/2026/179/oj/eng) — Brazilian courts have restricted the processing of data such as voter registration number, mother's name, lifestyle, social class, schooling, marginal propensity to consume and georeferencing for credit-protection purposes as not necessary.observed 2026-08-03