TMT: Cybersecurity and data privacy in Brazil

Mattos Filho, Veiga Filho, Marrey Jr. e Quiroga Advogados

Mattos Filho, Veiga Filho, Marrey Jr. e Quiroga Advogados provides advice across the entire spectrum of cybersecurity and data privacy; mandates range from advising on domestic and foreign data protection regulations to assisting in the preparation of corporate policies for the treatment of personal data. In addition, the team is proficient in big data, with the ability to advise on cybersecurity issues and data leaks. Brasília-based Thiago Luís Sombra is a name to note for data breach investigations. Paulo Brancher, who sits in the São Paulo office, is another key point of contact in the team, focusing on technology, telecoms and data protection.


‘This practice has excellent technical knowledge and is a pioneer in this area. The team is fast and proactive in terms of response and quick problem-solving. They are also very skilled in project management, as they dive deep into the client’s business and practices before settling a strategy.’ 

‘Paulo Marcos Rodrigues Brancher is highly regarded as a reference in Cybersecurity and Data Privacy, and his experience and extensive legal skills make him an excellent counsel for several companies. His leadership, along with his wide legal understanding and experience, was crucial to our Project.’

‘Camila Leal Calais performance was remarkable this year for our Project, which counted with her large experience and knowledge in the insurance market. Her top skills are counselling and communication skills.’

 ‘Mattos Filho, Veiga Filho, Marrey Jr e Quiroga Advogados holds a multitasked team composed of members with different seniority levels. Leading individuals are concerned about knowing the business and company’s particularities.’

‘In addition to having an immense analytical capacity, Thiago Sombra is an excellent lawyer who understands various subjects, and this multidisciplinary background contributes to excellent service.’

‘The team is formed by highly trained professionals and Paulo Brancher’s leadership enriches the discussions, considering his knowledge, commitment and availability.’

Pinheiro Neto Advogados

The data privacy and cybersecurity team at Pinheiro Neto Advogados offers assistance on the full range of related matters. Recent highlights saw the team advise leading international companies on aspects of the soon-to-be implemented General Data Protection Law (LGPD). The practice also excels in data breach remediation actions, as well as litigation involving data privacy and free speech rights. Larissa Galimberti stands out not only in technology transactions, but also in the drafting of data protection policies, data management procedures and cybersecurity issues, and Ciro Torres Freitas has substantial experience in data breach issues. The core team also includes seasoned practitioners Raphael de Cunto, André Zonaro Giacchetta and José Mauro Decoussau Machado. Marcel Leonardi left to establish his own firm in 2020.


‘They are top of the market in Brazil in terms of expertise, client relations, ease to work with, efficiency and overall friendliness.’

‘This specific team at Pinheiro Neto (Cybersecurity and data privacy), besides the knowledge involved, which provides comfort and security for its clients, has a very neat way of working, which puts the quality of their work in a very high standard.’

‘Ciro Freitas and Andre Giacchetta have been great and long time partners, not only on Cybersecurity and data privacy, but also on product implementation, litigation and law enforcement.’

Key clients

Laboratórios Pfizer




Banco Votorantim

Banco Pan

B3 S.A – Brasil, Bolsa, Balcão – “B3”


Banco BMG

First Data





Work highlights

  • Assisting Pfizer with a General Data Protection Law (LGPD) compliance project from the start, getting involved in every step of the project, from the data flow audit to reviewing all of the group’s agreements and policies.
  • Assisting HBO with its LGPD compliance project, which includes conducting a data inventory, analysing legal bases for processing, drafting and reviewing relevant documents.
  • Providing legal assistance to Unilever to help the company comply with the new Brazilian data protection law, by studying the differences in legislation in Europe and Brazil, from the point of view of marketing.
  • Assisted Fleury, a large laboratory analysis company, in the process of compliance with the LGPD.
  • Assisted Facebook Serviços Online do Brasil in the scope of a public civil action filed by a Brazilian association for the protection of consumers in the State of Mato Grosso do Sul due to an episode involving a breach of data.

Baptista Luz Advogados

Baptista Luz Advogados' data protection team specialises in transactions involving technology companies and innovative businesses. Apart from advising on the implementation of data protection compliance projects, in accordance with LGPD, GDPR and others, the practice is also adept at conducting audits, international data transfers as well as reviewing internal policies. Incident management in the context of data leaks and cyberattacks also features on the department's portfolio. Pedro Ramos leads the team, which includes Fernando Bousso, who combines solid experience in technology, telecoms and data privacy. Renato Leite Monteiro joined Twitter in 2020 and is now a consultant with the firm.

Practice head(s):

Pedro Ramos


‘We’ve worked with Batista Luz Advogados for quite some time now, and we’re delighted with the partnership with their office. Brazil is implementing its version of GDPR (LGPD), and the help and guidance of the team has been essential for my company to adequate its practices to this new law.’

‘Fernando Bousso advises us on data protection and legal issues. Fernando is a true collaborator. Every time that we need his support, he is always ready to help.’

Key clients

Arco Educação

CURA Diagnósticos


Darwin Starter


Estée Lauder Co.



Grupo Pão de Açúcar

Havas Group

Hospital A.C. Camargo

IAB Brasil

Leroy Merlin

Lufthansa Service Holding






Reclame Aqui

Resultados Digitais







Work highlights

  • Assisted Neoway in its data protection corporate governance programme, which included drafting legal opinions, developing internal and public policies, privacy by design methodologies towards the development of new products and services and regulatory impact assessments regarding new regulations.
  • Advised Grupo Pão de Açúcar in its joint venture with RaiaDrogasil, especially in data protection, intellectual property and technology transactions matters.

Opice Blum, Bruno, Abrusio, Vainzof Advogados Associados

Opice Blum, Bruno, Abrusio, Vainzof Advogados Associados is a prominent player in the field of technology and digital law, demonstrating a proven track in data privacy and cybersecurity issues. Besides advising on aspects of the new Brazilian General Data Protection Law (LGPD), the team excels in litigation concerning data breaches and the prevention of fraud. Renato Opice Blum, Marcos Bruno, Camilla Jimene and Caio César Carvalho Lima co-lead the team, while Rony Vainzof is a seasoned practitioner in cybersecurity. Since publicationJuliana Abrusio left the firm in September 2021.

Key clients


Bom Negócio Atividades de Internet


Car Dealerships

Work highlights

  • Defended Multiplus, currently Latam, in a case in which a person fraudulently acquired 484,700 points from a user of the airline’s rewards programme, which is managed by the client.
  • Retained by Bom Negócio Atividades de Internet to request the removal of groups created on Facebook which used the client’s name and brand resulting in IP infringement and anti-competitive practices.
  • Hired by Younder to issue a legal opinion about the risks involved in data processing operations carried out by means of an education platform, pursuant to the LGPD, the Internet Law (Marco Civil da Internet), the Brazilian Consumer Code, and other laws.

TozziniFreire Advogados

TozziniFreire Advogados receives instructions from both new entrants to the Brazilian market and companies with an established presence in the country, which seek the team's advice on a wide range of matters pertaining to cybersecurity and data privacy. Practice head Marcela Waksman Ejnisman has extensive experience in co-ordinating data protection conformity programmes to ensure clients' compliance with the upcoming Brazilian General Data Protection Law. Carla do Couto Hellu Battilana is another key practitioner, who often advises companies operating in the pharmaceutical, financial services, insurance and retail sectors.

Practice head(s):

Marcela Waksman Ejnisman


‘Brazil is quite different from a legal point of view than other countries in which we operate around the world.  Tozzini helps us understand these differences. They translate them for us. They are great lawyers and have great language skills.’

‘Marcela Waksman Ejnisman and Patrícia Helena Marta Martins are recommended.’

Key clients






Deutschland Bank






SBA Communications

Work highlights

  • Continuous assistance to Facebook, WhatsApp and Instagram in issues regarding the Brazilian consumer law, data protection and technology (including the review of privacy policy and terms and conditions documents, agreements, as well as regulatory advice).
  • Assisted Deutsche Bank with data protection issues, including the co-ordination of the company’s programme to implement compliance with the Brazilian Data Protection Law (LGPD).
  • Assistance to Febraban in mapping the laws and regulations applicable to financial institutions that are related to data protection.
  • Representing Facebook after a plaintiff filed a lawsuit requesting the removal of an offensive profile on the internet and compensation for moral damages, based on the Consumer Defense Code.

ASBZ Advogados

ASBZ Advogados is a solid performer in the field of data protection compliance consultancy, having recently advised extensively on the Brazilian General Data Protection law (LGPD). Department head Luiza Sato brings together expertise in the areas of digital law, IP and data protection, including data analytics and Internet of Things (IoT). Guilherme Braguim, who joined from Opice Blum, Bruno, Abrusio, Vainzof Advogados Associados in 2019, is another key individual; he is experienced in both contentious and non-contentious matters.

Practice head(s):

Luiza Sato


‘Top notch advice and up-to-date deep knowledge in a field that is evolving by the minute. Impressively efficient and able to find the angles that are the most relevant to my company’s activities.’

‘Luiza Sato is one of the most intelligent lawyers I have dealt with. She is as efficient as they come, is extremely creative and encourages and even challenges the client to also think outside the box.’

‘ASBZ has a great team. They are always careful and able to support us whenever we need. The lawyers that support us directly are Fernanda Catão and Luiza Sato. They are very supportive and careful. In the services they provide us, we feel that they have total knowledge of the subject, always updated and aware of what is going on. The understanding of the technological challenges and capabilities makes this team a champion.’

‘They are compromised and knowledgeable of both technology trends and law. This makes for an easy communication on different levels.’

Key clients

American Airlines

United Airlines

Air France / KLM

Fast Shop





CEVA Logistics




Instituto Devolver

Human Rights Watch

Fundação Zerrenner


Carteira Online





Work highlights

  • Advising American Airlines on the new Brazilian General Data Protection Law (LGPD), based on a prior European Union General Data Protection Regulation (GDPR) compliance project.
  • Conducted the assessment phase of the LGPD compliance project of Fast Shop, which is one of the largest retailers in Brazil.
  • Providing consultancy services related to the data protection requirements to be observed by Walmart when providing a public Wi-Fi service.

BMA - Barbosa, Müssnich, Aragão

BMA - Barbosa, Müssnich, Aragão provides comprehensive services to software developers, financial institutions, digital media companies and businesses with significant digital platforms in relation to the collection and treatment of personal data. Areas of activity include advising on terms of use and privacy policies, data transfer agreements, data leaks and digital incident management. Fabiana Fagundes leads the department. In recent team developments, José Eduardo Pieri left for Palma Guedes Advogados, while Felipe Palhares joined the firm in September 2020.

Practice head(s):

Fabiana Fagundes

Key clients

Grupo Globo





L’Oreal Brasil Comercial de Cosméticos

Aribnb Serviços Digitais

TruckPad Tecnologia e Logística

Work highlights

  • Assisting Grupo Globo with the assessment and review of its internal data protection practices in view of the new General Data Protection Law.
  • Assisted Chama, an online intermediary platform which connects consumers with natural gas retailers and truck drivers, with the preparation of a data-driven direct marketing strategy.
  • Assisted a client with the release of a mobile game, including advising on the data protection aspects.

Campos Mello Advogados in cooperation with DLA Piper

Drawing upon its co-operation with international powerhouse DLA PiperCampos Mello Advogados in cooperation with DLA Piper guides foreign companies through the intricacies of the Brazilian regulatory framework concerning data protection and cybersecurity. In addition, the team is proficient in the analysis of agreements related to data transfers, as well as due diligence exercises in the context of M&A transactions. Apart from helping develop preventive measures against cyberattacks, the practice is also adept at handling matters related to data breaches. Co-head Paula Mena Barreto regularly assists with privacy compliance issues, which is also an area of activity for co-leader Ricardo Caiado Lima. Manoela Quintas Esteves has extensive experience in data protection.

Demarest Advogados

Fielding specialised teams in advisory and litigation services, Demarest Advogados undertakes a wide array of work pertaining to data privacy and cybersecurity. The team is equipped to not only advise on privacy policies and terms of use, but also on the use and sharing of information. Other areas of expertise include big data and technologies related to the IoT. Assisting clients in compliance programmes with the new General Data Protection Law and handling data breach incidents are other notable areas of practice for the team, which is led by Tatiana Campello. Vanessa Ferro is another key contact. Since publication, the firm hired Eduardo Magrani to bolster its data protection and IP practices.

Practice head(s):

Tatiana Campello


‘The team demonstrates deep knowledge of a new matter. Lawyers have a professional approach and offer cautious recommendations aligned with the business intentions and particularities.’

‘Tatiana Campello stands out as a very experienced attorney and with a broad vision and insights on what might happen.’

Key clients

Mercadolivre Group

Vale S.A.

Work highlights

  • Advising Mercado Livre Grupo on the implementation of a complete project to comply with the General Data Protection Law (LGPD) and the adoption of all legal measures necessary to comply with privacy legislation.
  • Assisting VALE with a  review of policies and agreements (e.g. privacy policies, employee agreements, supplier agreements, etc) under the perspective of the Brazilian General Data Protection Law (LGPD).

Dias Carneiro Advogados

Dias Carneiro Advogados has a successful track record in issues related to privacy and data protection, drafting and reviewing internal policies on behalf of clients, as well as negotiating international data transfers. Its clients range from banks to data-driven companies, start-ups and game developers. Vanessa Pareja Lerner co-ordinates the department, bringing to the table expertise in technology and commercial contracts.

Practice head(s):

Vanessa Pareja Lerner


‘The Dias team are exceptional to work with, they are not only diligent with every detail but also understand our business to guide us through the issues that are important to us.’

‘We work closely with Juliana and Vanessa – both of which are great to work with. Our first engagement was a large, complex deal and both of them navigated the legal issues, all the while translating from Portuguese to English for us. They proved to drive closure by understanding both sides and determining the best course forward.’

‘DCA raises the bar by combining expertise with pragmatism. They are able to bring different perspectives and examples when asked to advise on how to solve issues, regardless of the area of knowledge (labour, IP, tax, digital,…). They know who to assign the questions within their team and coordinate their process to come up with an assertive resolution to us on time, in a multi-disciplinary approach.’

‘DCA professionals build a strong relationship with our teams based on trust, commitment with time, quality and transparency.’

Key clients

Neoway Tecnologia Integrada Assessoria e Negócios

Arquivei Serviços Online

Riot Games

2RM Tecnologia da Informação


Lalamove Tecnologia (Brasil)

Contratado Tecnologia

Intelipost Consultoria e Tecnologia

Work highlights

  • Provided ESML with a broad overview of Brazil’s LGPD, having assisted the client in the adaptation of its operations in Brazil in order to comply with the upcoming law.
  • Retained by Riot Games to advise on a global privacy policy that could be used throughout its games and throughout the world.
  • Developing Frubana Comércio e Distribuição de Alimentos’ privacy policy, terms and conditions and providing legal assistance on other technology law matters.

KLA Advogados

KLA Advogados has been particularly busy providing support to domestic and international clients in the implementation of privacy programmes following the enactment of the Brazilian General Data Protection Law. Moreover, the department is often retained to advise on the drafting and review of terms of use and agreements, contracts and internal privacy policies. Data breaches and other cybersecurity incidents are also part of the group's broad service offering. Tania Liberman, who combines solid expertise in technology, entertainment and data protection, oversees the department alongside Vanessa Pirró.

Practice head(s):

Tania Liberman; Vanessa Pirró

Key clients

Companhia Brasileira de Distribuição Eataly Distribuzione Srl

Companhia Brasileira de Águas – CAB Ambiental

Irwin Industrial Tool Ferramentas do Brasil

Sleep House Colchões e Acessórios

Imovelweb Comunicação

AKQA Brasil Comunicação

Labor Line Ind. e Com de Equipamentos Hospitalares e Laboratoriais

Rappi Brasil Intermediação de Negócios

Dryclean USA do Brasil Lavanderias

Work highlights

  • Assisting Cinemark with the creation and implementation of a privacy and data protection programme to guarantee compliance with Brazilian Data Protection Law (LGPD).
  • Assisted Duracell with the review and adaptation of the client’s documents related to the processing of personal data to the provisions of LGPD.
  • Advised Boston Scientific on the legality and main issues applicable to a health app through which patients could input their medical history.

Mundie e Advogados

Covering the full range of issues involving technology, internet and data protection, Mundie e Advogados offers advice to a diverse client base, which includes leading telecoms and media conglomerates, social media platforms, data controllers and over-the-top (OTT) media providers. The key points of contact for data privacy and cybersecurity include Ana Claudia Beppu, Elinor Cotait, Beatriz Faustino França and the recently promoted Tomás Paiva.

Pereira Neto | Macedo

Pereira Neto | Macedo has a solid track record in advising leading companies in Brazil on data protection and privacy analyses and the structuring of compliance programmes. The department routinely advises on the risk assessment and implementation of innovative technologies and business models from a data privacy viewpoint. Focusing on technology, IP and data protection, Ronaldo Lemos co-heads the practice group with Daniel Tinoco Douek. Natalia Langenegger is another notable practitioner in the team.

Key clients

Microsoft Informática

Vetor Brasil

Associação Renova BR

Fundação CPQD – Centro de Pesquisa e Desenvolvimento em Telecomunicações

Work highlights

  • Drafted a legal opinion for Microsoft concerning the social, economic and legal feasibility of the contracting of cloud services by São Paulo Court of Justice.
  • Retained by Vetor to provide a legal assessment regarding the compliance with LGPD.
  • Provides a specific compliance analysis for Renova BR regarding the processing of personal data carried out by the organisation.