Data:Brazil

'

'

Structure and Effectiveness of Brazilian Data Portability Regulation

Brazilian data portability rests on distinct instruments. The Constitution, article 5(LXXIX), protects personal data; the General Data Protection Law (LGPD), article 18(V), establishes a request-based right to data portability. Financial data sharing is governed by CMN/BCB Joint Resolution 1/2020, as amended by 4/2022; insurance by CNSP Resolution 415/2021 and SUSEP Circular 635/2021. Health-data exchange through the National Health Data Network (RNDS) follows Decree 12,560/2025. ANEEL's Open Energy remains a proposal under Public Consultation 7/2025. Consumer and competition legislation provides complementary safeguards. These regimes have different purposes and levels of legal maturity, not a single uniform portability standard.

From a rights perspective, article 18(V) establishes a statutory entitlement, but its exercise remains incompletely specified: it requires an express request, follows ANPD regulation and preserves commercial and industrial secrecy. In September 2026, the ANPD still listed regulation of data-subject rights as under internal preparation. That demonstrates an implementation gap, not suspension of the statutory right. RNDS interoperability likewise must not be mistaken for a general patient-directed portability mechanism.

For markets, mandatory participation and standardised interfaces can lower informational barriers to entry. Yet Open Finance activity measures technical uptake, not causally established reductions in prices or concentration. Research identifies continued concentration and implementation costs; competition effects require direct assessment.

Consumers may gain access to comparison tools and tailored offers, subject to comprehensible consent, security, and genuine choice. Survey findings associate lower income with lower reported adoption, without establishing national causal effects. Economic theory additionally suggests that refusal to share could disadvantage borrowers when lenders interpret non-disclosure adversely. 

For industry, shared interfaces reduce integration duplication but entail security and maintenance costs that smaller providers may struggle to bear. Ambiguous trade-secret exceptions and weak downstream safeguards can undermine confidence. Technical standardisation therefore requires public oversight, not merely industry agreement. 

Further legislation is neither necessarily sufficient nor the best immediate remedy. The stronger priority is binding ANPD regulation on scope, formats, timelines, secure direct transmission and reviewable secrecy refusals, coordinated with sector regulators. Accessible consent processes, independent testing, shared technical tools, consumer education and collective redress should complement regulation. 

Success should be measured against completed transfers, switching, prices, market entry, complaints, security incidents, and distributionBrazilian Data participation. Brazil demonstrates operational possibilities; its broader rights and welfare effects remain to be established