Legal support for foreign apps in Brazil involves assessing judicial requests, coordinating the company’s response and addressing any fines or service restrictions. When a messaging service, SaaS provider or digital platform receives a Brazilian court order, the response should bring together Brazilian counsel, the company’s international legal team and the technical staff responsible for the relevant systems.
The first questions are practical: what has been ordered, which entity must respond, what deadline applies and what information or action is actually available? A support ticket or an automated reply may document receipt, but the company still needs to assess whether a formal submission is required in the proceedings.
Why can Brazilian court orders affect a foreign app?
Incorporation abroad does not, by itself, resolve the applicability of Brazilian internet law. Article 11 of the Marco Civil da Internet addresses data-related operations with a Brazilian connection, including the conditions for its application to providers established abroad. The analysis must identify the relevant operation, users, entities and territorial links.
A request should therefore be assessed on its own terms. The location of a server is one fact; the identity of the provider, its control over information and the nature of the proceedings may also matter. Broader commercial and corporate questions can be considered alongside legal advice for foreign companies operating in Brazil.
What did the STF decide about direct data requests?
According to the STF’s official summary of ADC 51, decided on 23 February 2023, direct requests for data and communications to technology companies are possible within the conditions identified in the judgment: data collection and processing in Brazil, possession or control by a company with representation in Brazil, and crimes committed by individuals located in the country. International criminal assistance agreements remain available.
For a company receiving a request, the practical implication is to obtain advice on the applicable route rather than assume that an international assistance procedure is always the only available mechanism. The judgment should not be treated as unrestricted authority for every request or as proof that every provider possesses the information sought.
What should a foreign app do after receiving a Brazilian court order?
Verify the request and obtain the complete case documents
The initial review should confirm the issuing authority, case number, addressee, operative wording and any later decisions. An email attachment may contain only part of the relevant history. Counsel should establish whether the communication concerns an existing obligation, a new order, a fine or implementation of a restriction.
The original message, attachments, headers, delivery records and internal routing history should be preserved for legal review. These materials can help reconstruct what reached the company and how it was handled.
A support email does not settle the service question
Delivery to a support address should not be assumed automatically valid or invalid as service or judicial notice. The assessment depends on the procedural rules, addressee and evidence. In civil proceedings, Article 239, paragraph 1, of the Code of Civil Procedure also makes voluntary appearance relevant to service defects and response deadlines.
Assign legal and technical responsibility
A designated legal contact should coordinate access to the case, advice and any filings. A technical contact should establish which systems, records and personnel are relevant. The company should identify who can approve a response and who can authorize any permitted disclosure or operational change.
The internal response plan should record the deadline and its basis, outstanding questions, responsible personnel and the next decision required. An extension request should be tracked separately from any decision granting additional time.
Separate preservation from disclosure
Article 10 and Article 15 of the Marco Civil da Internet distinguish safeguards for access to information from rules on retaining application access logs. A preservation request and a disclosure request should be reviewed separately.
The technical work should identify the exact account identifiers, date range, time zone and information category involved. Counsel can then assess the legal scope against what the company actually holds, is required to retain and can lawfully produce.
How should requests for encrypted messages and user data be assessed?
A response stating that the app uses encryption may be incomplete. The relevant technical question is which information the provider can access, for the specified users and period, under the architecture and retention arrangements actually in use.
| Information category | Question for the response team |
|---|---|
| Message content | Can the provider access plaintext, encrypted material, backups or any retained copy? |
| Account information | Which registration fields exist, and which entity holds them? |
| Access logs | Which identifiers and timestamps are retained for the relevant period? |
| Other operational records | What exists, what does it establish and is it within the request? |
This is an assessment framework, not a statement that every app holds each category or that every category can be disclosed. An inability to access message content does not establish an inability to supply all other information.
Document technical limitations precisely
Where compliance is technically impossible in whole or in part, the company should support that position with a specific explanation from appropriately informed personnel. Useful material may include a system description, retention settings, the relevant searches and a clear distinction between information never collected, information no longer retained and information inaccessible to the provider.
A technical statement should address the actual order and avoid claims broader than the evidence supports. Legal submissions and engineering explanations should also be consistent about which entity controls the service and the relevant records.
Consider privacy rules in the correct procedural context
The LGPD, Article 4, item III, provides a specific exclusion for processing exclusively for public security and criminal investigation or prosecution purposes, with safeguards addressed in that provision. Privacy analysis must therefore consider the purpose, actors and applicable regime. A generic reference to the LGPD does not resolve a criminal-investigation request.
Does a foreign app need legal representation in Brazil?
Hiring litigation counsel and satisfying regulatory representation requirements are different tasks. A mandate to prepare a defence should not be assumed to cover every function of a local representative.
The published text of Article 16-A of Decree 8,771/2016, introduced by Decree 12,975/2026, contains local presence and legal representation requirements for application providers. It specifies powers relating to administrative and judicial matters, information, court orders and financial penalties, and requires the representative to be a legal entity.
The decree is the subject of a constitutional challenge, ADI 7981, as reported by the STF. The current procedural status and any applicable rulings should be checked when advising on an appointment. The existence of a challenge should not be confused with a decision suspending the rule.
Any appointment requires review of its scope, powers and responsibilities. Related guidance is available in the firm’s article on legal representation in Brazil for foreign clients.
Can an app challenge a fine or blocking order in Brazil?
Brazilian counsel should first identify the measure’s legal basis and procedural context. Article 12 of the Marco Civil da Internet provides sanctions for breaches of Articles 10 and 11, including fines and restrictions on the activities addressed there. That provision should not be treated as automatic authority for every service-wide blocking order.
A judicial fine intended to compel compliance requires separate analysis. In civil proceedings, Article 537 of the Code of Civil Procedure addresses coercive fines and grounds concerning modification or exclusion of future fines. Accrued amounts require their own assessment. Civil procedural provisions should not be applied indiscriminately to criminal proceedings.
Depending on the case, the review may address:
- The authority, legal basis and precise scope of the measure.
- The entity addressed and the relevant notification history.
- Clarity of the obligation and the opportunity to comply.
- Documented compliance, partial compliance or technical limitations.
- The proportionality and practical effects of the restriction.
- The procedural route and conditions for requesting urgent relief.
Under Article 995 of the Code of Civil Procedure, an appeal does not generally prevent a decision from taking effect unless the law or a judicial ruling provides otherwise. The response plan must distinguish filing a challenge from obtaining suspension of the measure.
If a restriction is lifted or narrowed, the team should verify the exact decision, its addressees and how implementation will be communicated and confirmed. A favourable filing outcome and restoration across affected services may require different follow-up steps.
What documents help Brazilian counsel assess the matter?
A focused instruction package should contain the complete order and available case documents; original communications and attachments; the receipt and response chronology; corporate details identifying the service operator; and any prior submissions, fines or restriction notices.
Technical material should explain the relevant service, data categories, retention arrangements and access limitations. The company should also identify its international legal contact, technical contact and authorized signatories. Sensitive case material should be shared through an agreed channel after conflict checking and clarification of the engagement.
Brazilian counsel can coordinate this work with the company’s overseas advisers. The firm’s guide to Brazilian legal support for foreign law firms explains how responsibilities and reporting can be organized.
How can foreign platforms prepare before an order arrives?
A response procedure should route court communications to designated legal personnel, maintain an auditable record of receipt and escalation, and identify the technical team able to verify relevant facts. It should also provide for review of representation arrangements and changes in Brazilian requirements.
The procedure should distinguish legal submissions, permitted disclosure and public communications. A statement issued for users or the press does not necessarily answer the questions before the court. This work can form part of a defined arrangement for ongoing legal support in Brazil.
Frequently asked questions
Does receiving a Brazilian order mean the entire app will be blocked?
No. The company must examine the actual order and any later decisions. A request for information, a fine, a targeted restriction and a service-wide blocking measure are different matters.
Can a foreign company respond through its existing support team?
The support team can help preserve and route communications. Whether a formal response, representation or filing is required must be assessed from the order and the proceedings. An automated acknowledgement should not be treated as completion of the legal response.
Does end-to-end encryption resolve every data request?
No. The assessment should distinguish message content from account information, access logs and other records. A precise response explains what is available and supports any claimed limitation.
Can Brazilian counsel work remotely with foreign executives and lawyers?
Much of the coordination can take place remotely, including document review, technical meetings and reporting in English. The authority and formalities needed for representation must still be confirmed for the particular matter.
Brazilian counsel for foreign apps and technology companies
Willian Nunes Advogados is based in Curitiba, Paraná, and assists foreign companies and overseas legal teams with legal matters connected to Brazil. Communication is available in Portuguese and English, with direct contact with Willian Nunes, the firm’s principal lawyer, OAB/PR 80.473.
Companies seeking an English-speaking lawyer in Brazil may submit an initial description through the contact page of Willian Nunes Advogados, identifying the authority, case number, known deadline and nature of the request. The appropriate scope of assistance depends on the documents, procedural position and technical facts.
This article provides general information. It does not establish the validity of a particular order, the availability of any remedy or the outcome of a request to lift restrictions or review a fine.