Signup

Home

Features

Resources

Compare

Documentation

Pricing

Signup

Home

Features

Resources

Compare

Documentation

Pricing

Signup

Brazil

Fully legal

Last updated on Aug 13, 2026

E-Signature Legality in Brazil

Brazil fully recognises electronic signatures under MP 2.200-2/2001 and Law 14.063/2020. Standard and advanced electronic signatures cover nearly all commercial B2B contracts, with ICP-Brasil reserved for a narrow, named list of exceptions.

Get your API key now

Overview

Intro & Key Facts

Quick Summary

Brazil recognises electronic signatures under Medida Provisória 2.200-2/2001 and Law 14.063/2020, and courts have gone out of their way to confirm it: in 2024, Brazil's Superior Court of Justice upheld a contract signed through a third-party platform without ICP-Brasil certification, rejecting mandatory qualified certification as excessive formalism. A narrow set of use cases still require ICP-Brasil, Brazil's own qualified-signature infrastructure - electronic tax invoices, real estate transfers, notarial deeds, and full legal replacement of paper health records. Foreign e-signature providers like Firma.dev operate freely for the standard and advanced tiers, and a January 2026 mutual adequacy decision between the EU and Brazil now gives EU-hosted processors a clear legal basis for handling Brazilian signers' data.

Practical Usage

Document Types in Brazil

Permitted Document Types

Commercial contracts
NDAs
Employment agreements
SaaS/software licenses
Vendor and service agreements
Purchase orders and non-fiscal invoices
Leases (as ordinary contracts)
Shareholder agreements not requiring registry filing

Restricted Document Types

Wills (testamento particular/público)
Notarial public deeds (escritura pública)
Real estate transfer and registration acts
Electronic tax invoices (NF-e)
Full legal replacement of paper health records
Most judicial and government filings

Common Exclusions

Brazilian law lets private parties use any signature method they agree to for ordinary contracts, while a formal simple/advanced/qualified tier system applies directly to interactions with public entities, corporate acts, health matters, and public-sector software licensing. ICP-Brasil, Brazil's qualified-signature infrastructure, is required with no advanced-signature workaround for tax invoices, real estate registration, and notarial acts.

Authentication Required

Simple electronic signature: No prescribed method - just needs the parties to accept it as valid.
Advanced electronic signature: Must be uniquely linked to the signatory, use signature-creation data under their sole control, identify the signatory, and detect any later change to the document (Law 14.063/2020, Art. 4) - the same test eIDAS uses for AES.
ICP-Brasil qualified signature: Requires a certificate issued under Brazil's public key infrastructure, supervised by ITI.

Restrictions

Signing Workflow Controls

Generally Permitted

Time-limited signature windows.
Sequential signing order.
Mandatory field completion.
Document expiration dates.
IP-based access restrictions.
Password-protected envelope access.
SMS verification codes.
Attachment requirements.

May Require Special Handling or Exclusions

Restrictions that prevent signers from reviewing the complete document before signing.
Restrictions that obscure material terms.
Blanket prohibitions on retaining personal copies.
Requirements for specific hardware or paid software to complete signing.

Legal Requirements

Brazil E-Signature Law Explained

Legal Frameworks

Medida Provisória 2.200-2/2001, Law 14.063/2020, and the Brazilian Civil Code (Law 10.406/2002)

Regulatory Bodies

ITI (Instituto Nacional de Tecnologia da Informação) administers ICP-Brasil, Brazil's public key infrastructure for qualified signatures. ANPD (Autoridade Nacional de Proteção de Dados) enforces LGPD, Brazil's data protection law.

`Minimum Retention`

Commercial contracts: 5-10 years depending on obligations (Civil Code Art. 1.194/205)
Tax documents: 5 years minimum (CTN Art. 173-174)
Labor/termination records: around 5 years post-termination (CLT)
Health records: 20 years minimum from the last entry (CFM Resolution 1.821/2007)

Retention Notes

Brazilian courts weigh audit trails (signer identification, IP logs, timestamps, authentication steps) heavily when a non-ICP-Brasil signature is challenged - the basis of the Superior Court of Justice's 2024 ruling validating a Clicksign-executed contract.

Data, Privacy & Cross-Border

Data Privacy and Compliance Brazil

Privacy Frameworks

LGPD (Lei Geral de Proteção de Dados, Law 13.709/2018), enforced by ANPD

Privacy Compliance Status

Firma.dev is GDPR-aligned and EU-hosted. LGPD hasn't been independently assessed against Firma.dev's substantive processing beyond the transfer mechanism, which the January 2026 EU-Brazil adequacy decision now covers.

Privacy Notes

LGPD's lawful bases and data-subject rights largely mirror GDPR. Key procedural differences: a 3-business-day breach notification window to ANPD versus GDPR's 72 hours, and a 15-day deadline to provide a complete data statement on request. ANPD fines run up to 2% of Brazilian gross revenue, capped at R$50 million per infraction.

Data Residency

Adequacy Decision

Yes - a mutual EU-Brazil adequacy decision took effect January 26, 2026: ANPD Resolution CD/ANPD No. 32/2026 recognizing the EU/EEA, alongside a corresponding European Commission decision under GDPR Art. 45 recognizing Brazil, both dated the same day. It's the first such mutual recognition between the EU and a Latin American country. Adequacy simplifies the transfer mechanism only - it doesn't independently certify that Firma.dev's broader processing meets every LGPD-specific requirement.

`Cross-Border Transfers`

Allowed via the January 2026 EU-Brazil mutual adequacy decision - no standard contractual clauses or other LGPD Art. 33 safeguards needed for transfers between Brazil and the EU/EEA, excluding public security, defense, and criminal-investigation transfers.

Residency Notes

LGPD does not require personal data to be stored within Brazil - the law applies based on whose data is processed, not where it's hosted. Storing data abroad is treated as an international transfer (see Cross-border Transfer), not a residency violation. Financial institutions face separate BACEN/exchange-control expectations that sit outside general LGPD residency rules and are worth checking with counsel for regulated fintech or government-sector customers specifically.

`Maximum Retention`

No statutory maximum located. LGPD's purpose-limitation principle requires deleting data once its purpose is fulfilled, subject to legal retention exceptions (tax, labor, litigation holds).

Industry Compatibility

E-Signatures by Industry in Brazil

Fully Supported Industries

General Commercial

SaaS Software

HR Tech Employment

Education/Edtech

Construction

Supported with Agreement

Healthcare

Life Sciences/Pharma

Insurance

Financial Services/Fintech

Legal Tech

Real Estate Tech

Should Consult Counsel

Government

Industry Matrix Notes

Most B2B commercial, SaaS, HR, education, and construction use cases work cleanly with a standard or advanced electronic signature. Healthcare, financial services, insurance, real estate, legal, and life sciences work for standard commercial documents but carry sector-specific carve-outs where ICP-Brasil is required (tax invoices, property registration, court filings, full health-record replacement, certain prescriptions). Government contracts require ICP-Brasil and sit outside Firma.dev's current scope.

General Commercial

Commercial contracts, vendor agreements, NDAs, and purchase orders are fully valid with a standard or advanced electronic signature under MP 2.200-2/2001, the Economic Freedom Act, and the Civil Code's freedom-of-form principle. No ICP-Brasil needed.

SaaS Software

Private SaaS and software licensing agreements fall under general contract law - a standard or advanced electronic signature is fully sufficient. Brazil's formal signature tiers apply to software licensed by public entities specifically, not ordinary B2B SaaS contracts.

Healthcare

Administrative and consent documents can generally use a standard or advanced electronic signature, but CFM Resolution 1.821/2007 requires an ICP-Brasil certificate, encryption, and full access traceability for an electronic health record to fully and legally replace paper. Health data is sensitive personal data under LGPD, requiring heightened safeguards.

Life Sciences/Pharma

Clinical trial agreements, CRO contracts, and research collaborations work with a standard or advanced electronic signature. Controlled-substance prescriptions require an ICP-Brasil-linked signature under CFM/ANVISA rules - worth confirming current requirements before building prescription workflows.

Insurance

General policies work with a standard or advanced electronic signature. No ICP-Brasil-specific mandate was found for SUSEP or ANS-regulated products in this research pass - treat as needing confirmation before targeting this vertical at scale.

Financial Services/Fintech

Brazil's Superior Court of Justice confirmed in 2025 that an advanced electronic signature with biometric and geolocation authentication is judicially acceptable for digital banking contracts, with the burden of proof on the institution if challenged. No blanket ICP-Brasil mandate was found for BACEN-regulated institutions, but sector-specific circulars are worth confirming before onboarding regulated fintech customers.

HR Tech Employment

Brazilian labor law (CLT) imposes no special form for employment contracts, and Labor Ministry Portaria MTP 671/2021 validated e-signature and digital storage of labor documents. A common risk-covering standard is to retain termination records for around 5 years post-termination.

Legal Tech

Client agreements and firm-side contracts work with a standard or advanced electronic signature. Court filings typically require ICP-Brasil certificates or gov.br-credentialed platform access rather than a generic third-party e-signature.

Real Estate Tech

Leases and property management agreements work with a standard or advanced electronic signature as ordinary contracts. Property transfer and registration acts require an ICP-Brasil qualified signature, and public deeds can only be executed remotely through the national e-Notariado platform.

Education/Edtech

Administrative and enrollment agreements work with a standard or advanced electronic signature. Official diplomas issued by public institutions may need institutional digital certificates - worth confirming with the institution directly.

Construction

Construction and subcontractor agreements work with a standard or advanced electronic signature under general commercial law, with no construction-specific restriction found beyond that.

Government

Brazil's formal signature-tier law governs interactions with public entities, frequently requiring an advanced or ICP-Brasil qualified signature. This sits outside Firma.dev's current scope - businesses contracting with government bodies should consult counsel on specific signing requirements.

How we works

How Firma.dev Works in Brazil

Firma.dev Supports

Firma.dev supports simple and advanced electronic signature (SES/AES) workflows, covering the vast majority of B2B commercial use cases in Brazil. Firma.dev does not integrate with ICP-Brasil, so its signatures do not satisfy Brazil's ICP-Brasil qualified-signature requirement for the narrow set of documents where it's mandated by law.

Firma.dev provides signer identification via email-link or SMS OTP authentication, tamper-evident documents with cryptographic sealing, complete audit trails with timestamped logging, and EU data hosting (AWS Paris).

Signer identification: Email-link or SMS OTP authentication
Tamper-evident documents: Cryptographic sealing detects any post-signing modification
Complete audit trails: Every action is timestamped and logged
EU data residency: All data hosted in AWS Paris

For the narrow set of Brazilian documents requiring an ICP-Brasil qualified signature, customers need a certificate issued under Brazil's own public key infrastructure instead.

const envelope = await firma.envelopes.create({
  title: 'Service Agreement',
  documents: [{ file: contractPdf }],
  signers: [{
    email: 'cliente@empresa.com.br',
    name: 'Ana Ferreira',
    locale: 'pt'
  }],
  metadata: {
    contract_type: 'service_agreement',
    jurisdiction: 'BR'
  }
});

const envelope = await firma.envelopes.create({
  title: 'Service Agreement',
  documents: [{ file: contractPdf }],
  signers: [{
    email: 'cliente@empresa.com.br',
    name: 'Ana Ferreira',
    locale: 'pt'
  }],
  metadata: {
    contract_type: 'service_agreement',
    jurisdiction: 'BR'
  }
});

const envelope = await firma.envelopes.create({
  title: 'Service Agreement',
  documents: [{ file: contractPdf }],
  signers: [{
    email: 'cliente@empresa.com.br',
    name: 'Ana Ferreira',
    locale: 'pt'
  }],
  metadata: {
    contract_type: 'service_agreement',
    jurisdiction: 'BR'
  }
});

Firma.dev's API-first design means signing can be embedded directly into your application. Companies working with Brazilian clients using Customer Workspaces get isolated environments per customer, with templates and envelope usage tracked separately.

Legal Details

Implementing E-Signatures in Brazil

Brazil's e-signature framework rests on three pillars: Medida Provisória 2.200-2/2001, Law 14.063/2020, and the Brazilian Civil Code.

MP 2.200-2/2001 established ICP-Brasil, Brazil's public key infrastructure, and set the baseline rule that still governs private contracts today: a document signed with an ICP-Brasil certificate is presumed authentic, but the law explicitly preserves the validity of any other signature method the parties agree to accept, with no automatic presumption attached. This freedom-of-form approach is reinforced by the Civil Code and the 2019 Economic Freedom Act, which validates private legal instruments executed by any means capable of proving authorship and integrity.

Signature Types Recognized

Law 14.063/2020 introduced a formal three-tier system - simple, advanced, and qualified - that textually applies to interactions with public entities, corporate acts, health matters, and public-sector software licensing. Courts have since applied the same substantive test to private disputes by analogy. The advanced tier's definition requires unique linkage to the signatory, identification of the signatory, signature-creation data under the signatory's sole control, and detection of any later change to the document - a near-identical test to the EU's AES standard.

The clearest signal of where Brazilian courts land on this came in 2024, when the Superior Court of Justice (STJ) ruled on a contract signed through a third-party e-signature platform without ICP-Brasil certification (REsp 2.159.442/PR). The Court explicitly rejected mandatory qualified certification as "excessive and unnecessary formalism" for an ordinary contract, accepting audit trails, IP logging, and multi-factor authentication as sufficient evidence of identity and integrity. A 2025 ruling (Tema Repetitivo 1061) went further for digital banking contracts, shifting the burden of proof to the institution when a consumer disputes a signature's authenticity.

ICP-Brasil remains a hard requirement, with no advanced-signature workaround, for a specific set of use cases: electronic tax invoices (NF-e), real estate transfer and registration acts, notarial public deeds, full legal replacement of paper health records, and most court and government filings. Outside those categories, ordinary commercial contracts, employment agreements, NDAs, and software licenses are fully valid with simple or advanced signatures.

For data protection, Brazil's LGPD closely mirrors GDPR in structure, with its own procedural specifics: a 3-business-day breach notification window to ANPD, and a 15-day deadline for data-subject requests. In January 2026, the European Commission and ANPD finalized a mutual adequacy decision, the first between the EU and a Latin American country, removing the need for Brazil-specific transfer safeguards when moving personal data between the EU/EEA and Brazil.

Recent developments

E-Signature Landscape in Brazil: 2026

STJ REsp 2.159.442/PR (2024): Validated an advanced electronic signature contract signed via a third-party platform without ICP-Brasil certification, rejecting mandatory qualified certification for ordinary contracts as "excessive formalism."

Law 14.620/2023: Amended CPC Art. 784 so e-signed private documents can qualify as directly enforceable executive titles without witnesses when a signature provider verifies integrity.

STJ Tema Repetitivo 1061 (2025): Shifted the burden of proof to the financial institution in disputed digital banking signatures.

EU-Brazil mutual adequacy decision (January 26, 2026): ANPD Resolution No. 32/2026 and a corresponding European Commission decision took effect the same day, letting personal data flow between Brazil and the EU/EEA without extra transfer safeguards - the first such mutual recognition between the EU and a Latin American country.

FAQ

Frequently asked questions

For any unanswered questions, reach out to our support team via email. We'll respond as soon as possible to assist you.

Are electronic signatures legal in Brazil?

Yes. MP 2.200-2/2001, Law 14.063/2020, and the Civil Code's freedom-of-form principle make electronic signatures valid and enforceable for commercial contracts. Brazilian courts, including the Superior Court of Justice, actively uphold e-signed agreements that reliably identify the signer and preserve document integrity, even without ICP-Brasil certification.

What types of e-signatures does Brazil recognise?

Brazil uses a simple, advanced, and qualified tier system, closely mirroring the EU's SES/AES/QES model. Qualified signatures run through ICP-Brasil, Brazil's own public key infrastructure, and carry a presumption of authenticity. Simple and advanced signatures remain valid and enforceable if the parties agree to use them and the method can be shown to reliably identify the signer.

Which documents require ICP-Brasil instead of a standard e-signature?

ICP-Brasil is required, with no advanced-signature alternative, for electronic tax invoices (NF-e), real estate transfer and registration acts, notarial public deeds, full legal replacement of paper health records, and most court and government filings. Ordinary commercial contracts, NDAs, employment agreements, and software licenses don't need it.

Can foreign e-signature providers operate in Brazil?

Yes. Brazilian law doesn't require a domestically licensed provider for simple or advanced electronic signatures used in private contracts. A 2024 Superior Court of Justice ruling explicitly rejected mandatory ICP-Brasil certification as excessive formalism for a contract signed through a third-party platform, provided the parties agreed to the method and it reliably identifies the signer.

What did Brazil's Superior Court of Justice rule on uncertified e-signatures?

In REsp 2.159.442/PR (2024), the STJ upheld a contract signed via a third-party e-signature platform without ICP-Brasil certification. The Court held that lack of qualified certification doesn't invalidate an advanced signature on its own, as long as the parties agreed to the platform and it identifies the signer and detects tampering - audit trails, IP logging, and multi-factor authentication were accepted as sufficient evidence.

How does Brazil handle cross-border data transfers for e-signatures?

As of January 2026, a mutual adequacy decision between the EU and Brazil lets personal data flow between the two without Brazil's standard contractual clauses or other extra safeguards under LGPD. This is the first such mutual recognition between the EU and a Latin American country, and it directly covers EU-hosted processors handling Brazilian signers' data.

What data protection rules apply to e-signatures in Brazil?

LGPD (Law 13.709/2018) governs personal data processing, with lawful-basis and data-subject-rights provisions similar to GDPR. Key differences to plan for: a 3-business-day breach notification window to ANPD versus GDPR's 72 hours, and a 15-day deadline to provide a complete data statement on request. ANPD fines run up to 2% of Brazilian gross revenue, capped at R$50 million per infraction.

What changed with the January 2026 EU-Brazil adequacy decision?

The European Commission and Brazil's ANPD finalized a mutual adequacy decision, recognising each other's data protection standards as equivalent. For any EU-hosted e-signature provider, this removes the need for Brazil-specific standard contractual clauses when handling Brazilian signers' personal data. Adequacy simplifies the transfer mechanism only - it doesn't independently certify that a provider's broader processing meets every LGPD-specific requirement.

FAQ

Frequently asked questions

For any unanswered questions, reach out to our support team via email. We'll respond as soon as possible to assist you.

Are electronic signatures legal in Brazil?

What types of e-signatures does Brazil recognise?

Which documents require ICP-Brasil instead of a standard e-signature?

Can foreign e-signature providers operate in Brazil?

What did Brazil's Superior Court of Justice rule on uncertified e-signatures?

How does Brazil handle cross-border data transfers for e-signatures?

What data protection rules apply to e-signatures in Brazil?

What changed with the January 2026 EU-Brazil adequacy decision?

FAQ

Frequently asked questions

For any unanswered questions, reach out to our support team via email. We'll respond as soon as possible to assist you.

Are electronic signatures legal in Brazil?

What types of e-signatures does Brazil recognise?

Which documents require ICP-Brasil instead of a standard e-signature?

Can foreign e-signature providers operate in Brazil?

What did Brazil's Superior Court of Justice rule on uncertified e-signatures?

How does Brazil handle cross-border data transfers for e-signatures?

What data protection rules apply to e-signatures in Brazil?

What changed with the January 2026 EU-Brazil adequacy decision?

Sources

MP 2.200-2/2001 (Planalto): planalto.gov.br
Law 14.063/2020 (Planalto): planalto.gov.br
Law 14.620/2023 analysis: Lopes & Castelo
STJ REsp 2.159.442/PR analysis: Silveiro Advogados
STJ Tema Repetitivo 1061 (2025) analysis: Migalhas
ITI / ICP-Brasil: gov.br/iti
ANPD: gov.br/anpd
LGPD Art. 52 sanctions: lgpd-brazil.info
ANPD breach notification, Resolution 15/2024: Confidata
EU-Brazil mutual adequacy decision: Baker McKenzie
EU-Brazil mutual adequacy decision (analysis): IAPP
CFM Resolution 1.821/2007: gov.br/conarq
Law 14.382/2022 registry law analysis: Migalhas
OneSpan Brazil legality guide: OneSpan
DocuSign Brazil legality guide: DocuSign

Start Building with Firma.dev

Firma.dev handles e-signatures for B2B SaaS, agencies, and internal teams working with Brazil. At €0.049 per envelope (~5¢) with no monthly minimums, you can ship signing flows designed to support Brazil's e-signature framework without enterprise contracts or procurement delays.

Get your API key now

Start Building with Firma.dev

Get your API key now

Start Building with Firma.dev

Get your API key now