Alerts
- 28 April 2025
-
Regulation of Data Centers under Discussion in Brazil
Over the past week, the Brazilian Government signaled that discussions regarding the regulation of data centers in Brazil are expected to move forward in the coming months, in light of two recent developments:
(i) progress in the legislative process of Bill No. 3018/2024 (“Bill No. 3018/2024”) in the Federal Senate, which aims to regulate artificial intelligence (“AI”) data centers in Brazil; and
(ii) the announcement of plans to establish a policy to attract investments in the development of new data center projects.
At the legislative level, the Senate’s Committee on Science, Technology, Innovation, and Information Technology approved, on April 23, 2025, a request for a public hearing to discuss Bill No. 3018/2024. The request was made by the bill’s rapporteur, Senator Vanderlan Cardoso (PSD-GO). The proposal aims to establish a comprehensive regulatory framework to ensure security, privacy, transparency, energy efficiency, and accountability in the use of these digital infrastructure elements.
The public hearing, scheduled for the first half of May (with no specific date yet confirmed), will include representatives from the Ministry of Science, Technology, and Innovation (MCTI); the National Data Protection Authority (ANPD); the Ministry of Development, Industry, Commerce, and Services (MDIC); the Ministry of Finance; and the Ministry of Mines and Energy (MME), as well as invited participants representing investors, industry associations, academics, and data center experts.
In parallel, specialized media reported that the Federal Government is currently prioritizing negotiations with Congress regarding the introduction of a legal framework to establish a special regime for attracting investment in data centers in Brazil. This framework, being drafted by the Ministry of Finance in coordination with the MDIC, MME, and MCTI, may be submitted to Congress either through a bill or a provisional measure.
Bill No. 3018/2024 under discussions in the Brazilian Senate
The initial draft of Bill No. 3018/2024 was submitted to the Federal Senate on August 1, 2024, by Senator Styvenson Valentim (Podemos-RN), and it is currently awaiting the issuance of a review report by the Committee on Science, Technology, Innovation, and Information Technology (CCT), followed by the Committee on Communication and Digital Law (CCDD).
Key points of the bill include:
– Definitions. The bill defines an AI data center as a structure dedicated to the centralization, interconnection, and operation of information technology equipment and telecommunications networks, capable of providing data storage, processing, and transport services, with the necessary levels of recovery and security for AI applications. An AI data center operator is defined as the individual or legal entity responsible for managing and operating these structures.
Main Responsibilities and Obligations for Data Centers. The bill outlines several key obligations for AI data centers, such as:
- Ensuring the physical and cybersecurity of stored and processed data;
- Preserving privacy and protecting personal data in accordance with the Brazilian General Data Protection Law (LGPD);
- Implementing measures to ensure transparency regarding data and AI algorithm use, including the disclosure of data sources and algorithm functionality;
- Adopting energy efficiency and environmental sustainability practices;
- Establishing audit and control mechanisms to prevent data and algorithm manipulation, ensuring traceability and integrity of operations; and
- Maintaining detailed operational records for at least five years..
Main Responsibilities and Obligations for Operators. Regarding AI data center operators, the bill imposes, among others, the following obligations::
- Establishing clear data governance policies covering data collection, storage, processing, sharing, and deletion;
- Appointing a Data Protection Officer, as required by the LGPD; e
- Ensuring the highest level of security and confidentiality for sensitive data processing.
Energy Efficiency and Sustainability. The bill emphasizes the adoption of energy efficiency and environmental sustainability technologies and practices, such as the use of renewable energy sources, efficient cooling systems, and hardware use optimization. It also requires periodic energy audits, annual energy consumption reports, greenhouse gas reduction targets, and the recycling and proper disposal of electronic equipment.
Monitoring and Penalties. – AI data centers will be subject to regular audits by independent, authorized entities, covering cybersecurity, data protection, and energy efficiency. Noncompliance will subject operators to the penalties provided for in existing legislation, including warnings, fines, suspension of activities, among other applicable penalties.
It is expected that during the legislative process of Bill No. 3018/2024 and particularly through technical, regulatory, and legal expert discussions, the proposal will be refined to incorporate clearer criteria regarding the security, availability, and volume of data processed in data centers. It is also expected that the bill will provide greater detail on the penalties applicable in case of non-compliance by operators, as well as define the government authority responsible for the enforcement, implementation, and oversight of the obligations and penalties to be established
Special Regime for Data Centers under Development by the Federal Government
Regarding the Federal Executive Branch’s plan to create a special tax regime for data centers, , specialized media outlets reported last week that the measure would involve tax exemptions on federal duties for the implementation of data center projects – this regime would be inspired by the Rehidro program, created in 2024 for the production and consumption of low-carbon hydrogen, with the probable exemption of taxes such as IPI, PIS, Cofins, and Import Tax.
In exchange, companies may be required to invest in developing the national supply chain for data center equipment, including research and development (R&D) initiatives, and to allocate a portion of their processing capacity to meet domestic demand. In this regard, given that the data storage market is—at least in part—global, the mandatory allocation of a percentage of capacity to the domestic market, without exceptions for cases of surplus supply, could lead to undesirable situations in some cases.
Also, there are discussions regarding the imposition of requirements such as reserving at least 10% of processing capacity for domestic demand; and allocating up to 8% of gross revenue generated by data center operations to the National Industrial and Technological Development Fund (FNDIT).
However, the prior determination of a fixed percentage may be subject to criticism, given the difficulty in assessing its reasonableness and proportionality, especially in a highly competitive market environment, including with data centers located in other countries. This is particularly sensitive when applied to gross revenue, which does not necessarily reflect the operator’s profit or financial outcome.
It is also expected that companies may be required to obtain environmental certifications and demonstrate the use of renewable energy sources to supply their operations, considering that electricity demand—stagnant for years in Brazil—may grow exponentially with the development of new data center facilities.
From a regulatory and legal perspective, it is crucial to structure solutions that ensure the connection of data centers to electricity distribution and transmission systems, given that the security and cost of energy supply are key factors for Brazil’s competitiveness in this sector.
In this context, it is also essential to pay close attention to regulatory requirements related to data center installation and operation, particularly those involving data protection, cybersecurity, and the structuring of contracts that properly allocate risks and obligations between the involved parties.
This topic is being closely monitored by Lefosse’s specialized and multidisciplinary Data Center team. For further clarification or assistance on any points discussed herein or related matters, please contact our professionals.
Tem alguma dúvida? Entre em contato com a nossa equipe marketing@lefosse.com
