Cybercrime Law in Brazil
Brazil’s framework combines criminal provisions in the Penal Code with a civil-rights internet statute and a comprehensive data-protection law.
Key laws
- Law No. 12.737/2012 (“Lei Carolina Dieckmann”) (30 November 2012) — added computer-crime offences to the Penal Code, notably art. 154-A (invasion of another person’s computing device) and art. 154-B (rules on who may bring the prosecution).
- Law No. 14.155/2021 (27 May 2021) — substantially rewrote the 2012 offences and is the current text you should read. It removed the requirement that the offender breach a security mechanism, raised the penalty for art. 154-A to 1–4 years’ imprisonment (2–5 years in the aggravated form of § 3), and created two new electronic-fraud offences: art. 155 § 4-B (theft by electronic fraud, 4–8 years) and art. 171 § 2-A (electronic fraud/estelionato, 4–8 years), with increases where a server outside Brazil is used or the victim is elderly or vulnerable.
- Marco Civil da Internet (Law No. 12.965/2014) (23 April 2014) — the “internet bill of rights,” setting principles for internet use, connection and application logs, and intermediary liability. Note that on 26 June 2025 the Federal Supreme Court (STF), deciding RE 1.037.396 (Tema 987) and RE 1.057.258 (Tema 533), held art. 19 — the rule that a platform is liable for third-party content only after ignoring a court order — to be partially unconstitutional, and set out circumstances in which platforms must act on notice instead. The STF directed that art. 19 be read in conformity with the Constitution until Congress legislates; as of August 2026 it had not, so the Court’s parameters govern. Read the STF’s published decision before relying on art. 19 as written.
- LGPD (Law No. 13.709/2018) (14 August 2018) — Brazil’s general data-protection law, as amended by Law No. 13.853/2019, which created the national data-protection authority (ANPD).
- Brazil is a party to the Budapest Convention on Cybercrime (ETS 185), which it acceded to on 30 November 2022 and which entered into force for Brazil on 1 March 2023. It is the basis for most of Brazil’s formal cross-border cooperation in cybercrime cases.
Enforcement
Federal and state civil police cybercrime units investigate offences; prosecution is by the Public Prosecutor’s Office. The ANPD supervises data protection under the LGPD.
Plain-language overview, not legal advice. Laws change — read the primary sources linked above and consult a qualified lawyer for any specific question.
Sources verified 26 August 2026 against Planalto (Presidência da República) official texts and the Council of Europe Treaty Office. The STF judgment date was confirmed from the Court’s own announcement; the STF site is not reachable from every network, so the linked page may need to be opened directly.