Contract intelligence
Contractor misclassification, contract lineage, NDAs, LGPD and electronic signatures. Each piece cites a primary source. This is not a legal magazine.
Lead
LGPD
What happened
On 19 Aug, at DNIT in Brasília, ANPD gathered DPOs under ‘Protection and governance in action’, livestreamed. The focus is the DPO’s strategic role, not the name on the website.
Costa Law reading
If your tech company’s DPO cannot be found by a data subject, the authority’s meeting already described your problem.
Ransomware at Instituto Saúde e Cidadania (Isac). The entity claimed attackers only reached already closed contracts. ANPD said that was not proven. It is investigating security, notice to victims and the DPO.
Data from a dead contract is still personal data. Retention, backup and incident notice are clauses, not an internal note.
Open sourceANPDMonitoring of 56 controllers (39 public, 17 private). 27 complied, 8 still have gaps, 21 stayed silent. The channel for data subjects and the authority is an obligation, not a footer line.
In the MSA and DPA, a DPO clause without a working channel is an operational lie. A tech company will meet that in a large customer's due diligence.
Open sourceANPDCycle 1 followed Metatext, Synapse AI and Prevvine. It was setup, not full testing. The report asks for better communication with USP and a synthetic-data protocol. Next cycles: security, transparency, governance and anonymization.
A tech company that trains or runs AI on customer data is already on the authority's radar, even in a sandbox. The processing contract and governance evidence enter due diligence.
Open sourceANPD sandboxJustice Gilmar Mendes allowed cases to proceed in first and second instance. After the TRT ruling, the stay returns until Theme 1.389 (ARE 1532603). At the TST, cases remain stayed.
A tech company that staffs through PJ entities did not get a free pass. It got a window for the contract to be fully instructed. The lineage of the front page (personal nature, exclusivity, tools, hours) goes into the record now.
Open sourceSTF newsWith the national stay lifted in first and second instance (Theme 1.389), what enters the case now is evidence: personal nature, exclusivity, hours, the taker’s tools, subordination.
Tip: reread the PDF today. If the contractor only uses the company email, only serves one client and clocks in, the CNPJ on the cover will not survive instruction.
Open sourceSTF 18 Jun 2026 (Theme 1.389)On 12 June, at Itamaraty, ANPD and DG CONNECT signed an administrative arrangement to exchange knowledge and mechanisms for protecting children online.
Anyone running an app, game or edtech in Brazil needs to treat minors as a product clause. The regulator is lining up with Europe on that point.
Open sourceANPD · DG CONNECT arrangementIndications of excessive sharing, lack of transparency and a hard-to-reach DPO. A warning covers current and future sharing contracts. The LGPD article 52 cap is a legal ceiling, not a fine already imposed.
The data contract (purpose, necessity, legal basis, DPO) is the product. Anyone who forwards a customer base to CRM, credit or AI sits in the same family of risk.
Open sourceANPDVALIDAR checks authorship and integrity of ICP-Brasil and gov.br signatures. June 2026 guidance: extra initials, several fields per signer, or mixing simple e-sign after ICP yields undetermined or failed status.
If the contract must pass the government validator, the envelope workflow is a legal artifact. A screenshot and a scribble are not cryptography.
Open sourceITI VALIDARThe Human Rights Ministry published CONATRAE Public Note 001/2026. A majority of the commission (CNI voted against) expressed concern about Theme 1.389 interpretations and their impact on contract lawfulness analysis.
The STF debate is not just retail labor litigation. It is contract design. A tech company needs to document real entrepreneurial activity, not just a CNPJ on the cover.
Open sourceMDHC / CONATRAEOn 7 May 2026 the Second Section judged REsps 1.873.187/SP and 1.873.811/SP (Justice Raul Araújo; opinions published 1 Jun 2026) and fixed Theme 1.210. In civil and commercial relations, piercing the corporate veil under Civil Code article 50 (maior theory) requires actual proof of abuse, shown as deviation of purpose or commingling of assets. Mere lack of attachable assets or irregular winding-up, alone or together, is not enough. The holding binds equivalent cases under CPC article 927, III. It does not automatically migrate to consumer, labour or tax-enforcement regimes.
A tech Ltda is not a shield against fraud, and it does not fall just because the till hit zero. A creditor must plead and prove abuse; default does not presume fraud. Founder: company accounts do not mix with personal ones. Do not confuse this with pejotização (Theme 1.389) or CDC article 28.
Open sourceSTJ 29 Jul 2026 (Theme 1.210)From 1 May 2026, FGTS collections arising from a judgment or settlement (CCP/Ninter) go out on the FGTS Digital slip. The eSocial S-2500 event was already mandatory.
A tech company that loses (or settles) a PJ claim needs legal and payroll aligned. The services contract does not wipe the payment slip.
Open sourceeSocial / FGTS DigitalBetween 20 and 24 April ANPD joined a European Commission TAIEX mission on digital-environment regulation, algorithmic transparency and protection of minors, with the Justice Ministry and Secom.
AI in the product (credit, ranking, moderation) needs an explainability clause in the contract, not just ‘proprietary model’.
Open sourceANPD 24 Apr 2026Same panel: Law 14.063 draws simple, advanced and qualified e-signatures. A private power of attorney can stand without ICP. If the judge doubts authenticity, a qualified signature can be required.
Anyone who designs mandate, NDA and online acceptance flows picks the signature level before the fight, not at trial.
Open sourceSTJ 31 Mar 2026London mission (23 to 25 Mar). Agenda with the ICO: age assurance, protection of minors on platforms, and Law 15.211/2025 (children's rights in digital environments).
A tech product with a child account in Brazil now has a new statute, not only LGPD. Age, design and ads enter the product contract, not just the DPA.
Open sourceANPD 25 Mar 2026The review assistant announced on 25 Mar compares the agreement to the house playbook. Without an internal standard (term, forum, data, residual, residual IP, residuals), AI only summarizes the PDF.
Build the playbook before the tool. Five minimum positions: term, forum, personal data, residual IP and what happens at termination.
Open sourceDocusign IR 25 Mar 2026On 25 March 2026, Docusign launched an assistant that compares the agreement to the internal playbook, suggests a redline and points to the clause. Momentum pushed the same axis: agents over the corpus, not a loose chat.
The tech company's asset is the playbook (NDA, MSA, DPA, PJ). Without a playbook, AI summarizes. With a playbook, front-page lineage becomes operations. Costa Law does not advertise a partner product; it describes the method.
Open sourceDocusign IR 25 Mar 2026In Theme 1.061 the STJ held that, once authenticity of a signature is challenged, the burden of proving authenticity of the electronic document sits on whoever produced it. Special Appeal 2.197.156 of 2026 applied that logic.
Keep the evidence file on the same day as the signature. After the fight, rebuilding the trail is expensive and sometimes impossible.
Open sourceSTJ Theme 1.061 / REsp 2.197.156Special Appeal 2,197,156, 3rd Panel, Justice Nancy Andrighi. A loan signed on a non-ICP platform. Selfie, geolocation, documents and device use counted as acceptance of the method. A generic challenge is not enough.
What a SaaS company must keep is not a PNG of a scribble. It is the trail: IP, device, time, hash, evidence of intent. The case is a payroll loan; the proof method carries into B2B contracts.
Open sourceSTJ 18 Mar 20266th Panel: where there is reasonable doubt about the integrity and authenticity of digital evidence, an expert exam is required. Prints taken by direct access to the phone, without technical safeguards, led to replacing pretrial detention until that exam.
A company that ‘closes the deal on WhatsApp’ and keeps only a print is collecting fragile evidence. Commercial acceptance needs a trail (hash, time, device), not a screenshot.
Open sourceSTJ 9 Mar 2026The National Corregedor set minimum ICT standards for notarial and registry services: security, integrity, availability, authenticity and traceability. It repealed Provimento 74/2018.
A contract that still depends on a registry (real estate, security, corporate change) needs an envelope the notary can validate. A screenshot is not on that list.
Open sourceCNJ Provimento 213/2026ANPD announced reciprocal adequacy. Personal data can flow between Brazil and the EU without an extra contractual mechanism, because the laws were treated as equivalent.
A SaaS with data in Europe and operations in Brazil no longer relies only on standard clauses for that flow. The MSA still must say where the data lives and who the exporter is.
Open sourceANPD 23 Jan 2026The international-transfer regulation and standard clauses (Res. 19/2024) require the text to be adopted in full, unedited. Transfers to a non-adequate country need that pack or a specific clause approved by ANPD.
A US vendor outside the EU still sits in the standard-clause regime. Copying the annex and ‘improving’ the text voids the transfer.
Open sourceANPD Resolution 19/2024Res. 2/2022 eases duties of small agents (impact report, DPO), but does not waive legal basis, security or data-subject rights. High risk and large-scale processing remove the benefit.
A tech startup that calls itself ‘small’ and processes data of thousands of users has probably left the flexibility. The large-customer contract will still demand a DPO.
Open sourceANPD Resolution 2/2022Law 14.195 inserted article 110-A into the Corporations Act. A class of ordinary shares may carry up to 10 votes per share, in a closed company or in a public one if created before listing. Initial term of up to 7 years, renewable. It falls away on transfer to a third party, save narrow cases. It does not apply to votes on director pay or material related-party deals.
Bylaws and a shareholders' agreement belong on the round table, not after valuation. Without plural voting, the term sheet decides the company.
Open sourceCorporations Act, art. 110-A (Law 14.195/2021)LC 182 allows capital via option, convertible debenture, convertible loan, silent partnership and angel notes without joining the share capital. The investor is not a partner, has no management vote and is not liable for company debt, including in restructuring. Intent, fraud or simulation involving the investor fall outside the shield. Civil Code article 50 does not extend to him.
An instrument that grants a vote or management breaks the paper. Together with Theme 1.210: a badly written note turns the fund into a piercing target.
Open sourceLC 182/2021, arts. 5 and 8LC 182 creates the Public Contract for an Innovative Solution. Term of up to 12 months, renewable once. Cap of BRL 1.6 million. The contract must fix ownership of IP in the resulting creations and the share in commercial exploitation, licensing and technology transfer.
A CPSI is not a SaaS MSA. Whoever licenses the model after the pilot must sit in the paper, with a technology-risk matrix.
Open sourceLC 182/2021, art. 14The decree regulates Law 14.063 in the federal Executive and maps when a simple, advanced or qualified signature is required in administrative acts.
Anyone selling to government does not pick the level in the pitch. The decree already did. The envelope must be born at the right level.
Open sourceDecree 10.543/2020The statute classifies e-signatures in three levels, with rising identification and integrity requirements. Acts with the public administration and public-health matters have their own minimum-level rules.
An internal NDA can be simple. A change in the corporate board and an act with the tax authority ask for qualified. Mixing the three in one envelope is the error VALIDAR catches.
Open sourceLaw 14.063/2020Law 13.874/2019 reinforces freedom of contract and the presumption of good faith between capable private parties. It does not erase LGPD, the Consumer Code when it applies, or pejotização.
Use the statute to defend the bargain. Do not use it to hide subordination in a PJ arrangement or personal data without a basis.
Open sourceLaw 13.874/2019Art. 46 requires the controller/processor to adopt technical and administrative measures able to protect data from unauthorized access and from accidental or unlawful events. The standard is proportionate to the risk.
In the MSA, ‘we use encryption’ without saying what, where and for how long is a slogan. The clause needs retention, backup, incident and a DPO.
Open sourceLaw 13.709/2018, art. 46Art. 15 covers the end of processing. Erasure is the rule; retention only in the statutory cases (legal duty, research, transfer, exclusive controller use with anonymization).
The excuse ‘it was only a dead contract’ already showed up in the Isac case. The retention clause needs a term and a basis, not a forgotten S3 folder.
Open sourceLaw 13.709/2018, art. 15Agreements that limit or control technological R&D, or that hoard IP rights, are infringements if they produce the effects in article 36. Concentration acts (merger, acquisition of control or of a material asset) go to Cade when they meet the turnovers in article 88.
Exclusivity of the kind 'the customer only uses our model' and the purchase of a small rival sit on the antitrust radar, not only in the SPA.
Open sourceLaw 12.529/2011, arts. 36 and 88Art. 104 lists the validity requirements of a juridical act. Art. 107 says the validity of a declaration of will does not depend on a special form, unless the law requires one.
A one-page NDA in email can stand. What kills it is an impossible clause (eternal term, incompatible forum, personal data without a basis). Front-page lineage remains mandatory.
Open sourceCivil Code, arts. 104 and 107The provisional measure that created ICP-Brasil says, in art. 10 §2, that it does not bar other means of proving authorship and integrity, including certificates not issued by ICP-Brasil.
Operational tip: the signature level is chosen in the playbook (simple, advanced, qualified), not by sales guesswork. The MP opens the door; the trail closes the proof.
Open sourceMP 2.200-2/2001Unless agreed otherwise, rights in a program developed during an employment, services or statutory tie, aimed at R&D or inherent in the role, belong to the employer or contracting party. If the employee made it with no link to the contract and no company resources, the rights are his. The same applies to grant holders and interns.
Dev contract and NDA: the copilot output, the repo and the fine-tune. Without that, the technical co-founder walks out with the product.
Open sourceLaw 9.609/1998, art. 4Use of computer programs in Brazil is the subject of a licence. The document must state the technical validity of the version. The seller must support it during that term. A technology-transfer of a program is registered at INPI and requires delivery of commented source code and a memorial. Clauses that unlawfully limit commercialisation or waive liability for defects and copyright infringement are void.
An MSA that only says 'API access' hides whether it is a licence, whether support lasts the term, and whether the customer can demand the source.
Open sourceLaw 9.609/1998, arts. 7 to 11Under the copyright statute, the author is the natural person who creates. Ideas, business methods, systems and mathematical concepts are not works. Assignment of economic rights is in writing, is construed narrowly and, if silent, lasts at most five years.
Terms of use and MSA: who owns the output, what the customer may resell, what the vendor may train again. Without a human creator, the protection vanishes.
Open sourceLaw 9.610/1998, arts. 8, 11 and 49A computer program as such is not an invention, nor are commercial, financial or advertising schemes, plans or methods. A patentable invention needs novelty, inventive step and industrial application.
What the founder calls 'the algorithm' is almost never a patent. The asset is secrecy, brand and contract. Do not spend a round on a filing INPI will refuse.
Open sourceLaw 9.279/1996, arts. 8 and 10If the employment contract is for research or inventive activity, the invention is the employer's and, unless agreed, pay is the salary. If the employee invents off-contract and without company resources, it is his. If personal contribution mixes with company resources, ownership is equal unless agreed. It applies, as relevant, to contractors, interns and the contracting company.
Offer letter and contractor agreement: research, equipment, company data and what happens one year after exit. Without that, the patent filing becomes a co-founder fight.
Open sourceLaw 9.279/1996, arts. 88 to 92Industrial-property protection includes repression of unfair competition. It is an offence, among other cases, to disclose, exploit or use, without authorisation, confidential knowledge, information or data usable in industry, trade or services, obtained through a contractual or employment relationship, even after the contract ends.
NDA and a residual clause: what the ex-partner, the vendor and the fund do not take. A secret only exists if the house treats weights, prompts and the playbook as a secret.
Open sourceLaw 9.279/1996, arts. 2(V) and 195Let's Talk
Schedule a strategic conversation and discover how we can drive your business growth with legal security.