Contract intelligence

Thesis radar for technology companies

Contractor misclassification, contract lineage, NDAs, LGPD and electronic signatures. Each piece cites a primary source. This is not a legal magazine.

01

Lead

PJ contracts

STF lifts the pejotização stay only in first instance and regional labor courts

What happened

Justice Gilmar Mendes allowed cases to proceed in first and second instance. After the TRT ruling, the stay returns until Theme 1.389 (ARE 1532603). At the TST, cases remain stayed.

Costa Law reading

A tech company that staffs through PJ entities did not get a free pass. It got a window for the contract to be fully instructed. The lineage of the front page (personal nature, exclusivity, tools, hours) goes into the record now.

Open sourceSTF news
  1. 02
    PJ contracts

    CONATRAE issues a note on fraudulent pejotização in Theme 1.389

    The Human Rights Ministry published CONATRAE Public Note 001/2026. A majority of the commission (CNI voted against) expressed concern about Theme 1.389 interpretations and their impact on contract lawfulness analysis.

    The STF debate is not just retail labor litigation. It is contract design. A tech company needs to document real entrepreneurial activity, not just a CNPJ on the cover.

    Open sourceMDHC / CONATRAE
  2. 03
    LGPD

    ANPD opens a sanctioning case against Claro over data sharing with Serasa

    Indications of excessive sharing, lack of transparency and a hard-to-reach DPO. A warning covers current and future sharing contracts. The LGPD article 52 cap is a legal ceiling, not a fine already imposed.

    The data contract (purpose, necessity, legal basis, DPO) is the product. Anyone who forwards a customer base to CRM, credit or AI sits in the same family of risk.

    Open sourceANPD
  3. 04
    LGPD

    ANPD: 21 companies and agencies did not respond on the DPO

    Monitoring of 56 controllers (39 public, 17 private). 27 complied, 8 still have gaps, 21 stayed silent. The channel for data subjects and the authority is an obligation, not a footer line.

    In the MSA and DPA, a DPO clause without a working channel is an operational lie. A tech company will meet that in a large customer's due diligence.

    Open sourceANPD
  4. 05
    LGPD

    ANPD opens a sanction case after an incident affecting 500,000 patients

    Ransomware at Instituto Saúde e Cidadania (Isac). The entity claimed attackers only reached already closed contracts. ANPD said that was not proven. It is investigating security, notice to victims and the DPO.

    Data from a dead contract is still personal data. Retention, backup and incident notice are clauses, not an internal note.

    Open sourceANPD
  5. 06
    Signature

    STJ: lack of ICP-Brasil alone does not void a digital contract

    Special Appeal 2,197,156, 3rd Panel, Justice Nancy Andrighi. A loan signed on a non-ICP platform. Selfie, geolocation, documents and device use counted as acceptance of the method. A generic challenge is not enough.

    What a SaaS company must keep is not a PNG of a scribble. It is the trail: IP, device, time, hash, evidence of intent. The case is a payroll loan; the proof method carries into B2B contracts.

    Open sourceSTJ 18 Mar 2026
  6. 07
    Signature

    STJ: an electronic power of attorney without ICP can stand; doubt raises the level

    Same panel: Law 14.063 draws simple, advanced and qualified e-signatures. A private power of attorney can stand without ICP. If the judge doubts authenticity, a qualified signature can be required.

    Anyone who designs mandate, NDA and online acceptance flows picks the signature level before the fight, not at trial.

    Open sourceSTJ 31 Mar 2026
  7. 08
    Signature

    VALIDAR (ITI) does not validate an image; the ICP flow has envelope rules

    VALIDAR checks authorship and integrity of ICP-Brasil and gov.br signatures. June 2026 guidance: extra initials, several fields per signer, or mixing simple e-sign after ICP yields undetermined or failed status.

    If the contract must pass the government validator, the envelope workflow is a legal artifact. A screenshot and a scribble are not cryptography.

    Open sourceITI VALIDAR
  8. 09
    NDA and playbook

    Contract review against the house playbook, not against a chat window

    On 25 March 2026, Docusign launched an assistant that compares the agreement to the internal playbook, suggests a redline and points to the clause. Momentum pushed the same axis: agents over the corpus, not a loose chat.

    The tech company's asset is the playbook (NDA, MSA, DPA, PJ). Without a playbook, AI summarizes. With a playbook, front-page lineage becomes operations. Costa Law does not advertise a partner product; it describes the method.

    Open sourceDocusign IR 25 Mar 2026
  9. 10
    AI and data

    ANPD publishes the first report of its AI sandbox

    Cycle 1 followed Metatext, Synapse AI and Prevvine. It was setup, not full testing. The report asks for better communication with USP and a synthetic-data protocol. Next cycles: security, transparency, governance and anonymization.

    A tech company that trains or runs AI on customer data is already on the authority's radar, even in a sandbox. The processing contract and governance evidence enter due diligence.

    Open sourceANPD sandbox
  10. 11
    LGPD

    Brazil and the EU recognize mutual data-protection adequacy

    ANPD announced reciprocal adequacy. Personal data can flow between Brazil and the EU without an extra contractual mechanism, because the laws were treated as equivalent.

    A SaaS with data in Europe and operations in Brazil no longer relies only on standard clauses for that flow. The MSA still must say where the data lives and who the exporter is.

    Open sourceANPD 23 Jan 2026
  11. 12
    LGPD

    ANPD Resolution 19: the standard clause is not to be rewritten

    The international-transfer regulation and standard clauses (Res. 19/2024) require the text to be adopted in full, unedited. Transfers to a non-adequate country need that pack or a specific clause approved by ANPD.

    A US vendor outside the EU still sits in the standard-clause regime. Copying the annex and ‘improving’ the text voids the transfer.

    Open sourceANPD Resolution 19/2024
  12. 13
    LGPD

    ANPD takes the Digital ECA (Law 15.211/2025) to the ICO in London

    London mission (23 to 25 Mar). Agenda with the ICO: age assurance, protection of minors on platforms, and Law 15.211/2025 (children's rights in digital environments).

    A tech product with a child account in Brazil now has a new statute, not only LGPD. Age, design and ads enter the product contract, not just the DPA.

    Open sourceANPD 25 Mar 2026
  13. 14
    LGPD

    ANPD signs an agreement with the European Commission (DG CONNECT) on minors

    On 12 June, at Itamaraty, ANPD and DG CONNECT signed an administrative arrangement to exchange knowledge and mechanisms for protecting children online.

    Anyone running an app, game or edtech in Brazil needs to treat minors as a product clause. The regulator is lining up with Europe on that point.

    Open sourceANPD · DG CONNECT arrangement
  14. 15
    Signature

    CNJ Provimento 213/2026: digital notaries with a mandatory trail

    The National Corregedor set minimum ICT standards for notarial and registry services: security, integrity, availability, authenticity and traceability. It repealed Provimento 74/2018.

    A contract that still depends on a registry (real estate, security, corporate change) needs an envelope the notary can validate. A screenshot is not on that list.

    Open sourceCNJ Provimento 213/2026
  15. 16
    Signature

    STJ: a WhatsApp print without a chain of custody is not enough

    6th Panel: where there is reasonable doubt about the integrity and authenticity of digital evidence, an expert exam is required. Prints taken by direct access to the phone, without technical safeguards, led to replacing pretrial detention until that exam.

    A company that ‘closes the deal on WhatsApp’ and keeps only a print is collecting fragile evidence. Commercial acceptance needs a trail (hash, time, device), not a screenshot.

    Open sourceSTJ 9 Mar 2026
  16. 17
    Signature

    MP 2.200-2, art. 10 §2: ICP is not the only means of proof

    The provisional measure that created ICP-Brasil says, in art. 10 §2, that it does not bar other means of proving authorship and integrity, including certificates not issued by ICP-Brasil.

    Operational tip: the signature level is chosen in the playbook (simple, advanced, qualified), not by sales guesswork. The MP opens the door; the trail closes the proof.

    Open sourceMP 2.200-2/2001
  17. 18
    Signature

    Law 14.063: simple, advanced and qualified are not synonyms

    The statute classifies e-signatures in three levels, with rising identification and integrity requirements. Acts with the public administration and public-health matters have their own minimum-level rules.

    An internal NDA can be simple. A change in the corporate board and an act with the tax authority ask for qualified. Mixing the three in one envelope is the error VALIDAR catches.

    Open sourceLaw 14.063/2020
  18. 19
    Signature

    Decree 10.543: the federal government already picked the level by type of act

    The decree regulates Law 14.063 in the federal Executive and maps when a simple, advanced or qualified signature is required in administrative acts.

    Anyone selling to government does not pick the level in the pitch. The decree already did. The envelope must be born at the right level.

    Open sourceDecree 10.543/2020
  19. 20
    LGPD

    LGPD art. 46: security is a clause, not a marketing annex

    Art. 46 requires the controller/processor to adopt technical and administrative measures able to protect data from unauthorized access and from accidental or unlawful events. The standard is proportionate to the risk.

    In the MSA, ‘we use encryption’ without saying what, where and for how long is a slogan. The clause needs retention, backup, incident and a DPO.

    Open sourceLaw 13.709/2018, art. 46
  20. 21
    PJ contracts

    FGTS Digital starts collecting FGTS from labor judgments

    From 1 May 2026, FGTS collections arising from a judgment or settlement (CCP/Ninter) go out on the FGTS Digital slip. The eSocial S-2500 event was already mandatory.

    A tech company that loses (or settles) a PJ claim needs legal and payroll aligned. The services contract does not wipe the payment slip.

    Open sourceeSocial / FGTS Digital
  21. 22
    LGPD

    3rd ANPD DPO meeting: the DPO became a governance agenda

    On 19 Aug, at DNIT in Brasília, ANPD gathered DPOs under ‘Protection and governance in action’, livestreamed. The focus is the DPO’s strategic role, not the name on the website.

    If your tech company’s DPO cannot be found by a data subject, the authority’s meeting already described your problem.

    Open sourceANPD 9 Jul 2026
  22. 23
    NDA and playbook

    Civil Code arts. 104 and 107: the NDA stands on consent, not on a pretty PDF

    Art. 104 lists the validity requirements of a juridical act. Art. 107 says the validity of a declaration of will does not depend on a special form, unless the law requires one.

    A one-page NDA in email can stand. What kills it is an impossible clause (eternal term, incompatible forum, personal data without a basis). Front-page lineage remains mandatory.

    Open sourceCivil Code, arts. 104 and 107
  23. 24
    NDA and playbook

    Economic Freedom Law: presumption of good faith in business contracts

    Law 13.874/2019 reinforces freedom of contract and the presumption of good faith between capable private parties. It does not erase LGPD, the Consumer Code when it applies, or pejotização.

    Use the statute to defend the bargain. Do not use it to hide subordination in a PJ arrangement or personal data without a basis.

    Open sourceLaw 13.874/2019
  24. 25
    Signature

    STJ Theme 1.061: whoever relies on the digital contract proves authenticity

    In Theme 1.061 the STJ held that, once authenticity of a signature is challenged, the burden of proving authenticity of the electronic document sits on whoever produced it. Special Appeal 2.197.156 of 2026 applied that logic.

    Keep the evidence file on the same day as the signature. After the fight, rebuilding the trail is expensive and sometimes impossible.

    Open sourceSTJ Theme 1.061 / REsp 2.197.156
  25. 26
    AI and data

    ANPD in Europe (TAIEX): algorithmic transparency becomes a state agenda

    Between 20 and 24 April ANPD joined a European Commission TAIEX mission on digital-environment regulation, algorithmic transparency and protection of minors, with the Justice Ministry and Secom.

    AI in the product (credit, ranking, moderation) needs an explainability clause in the contract, not just ‘proprietary model’.

    Open sourceANPD 24 Apr 2026
  26. 27
    LGPD

    LGPD art. 15: a closed contract still holds data

    Art. 15 covers the end of processing. Erasure is the rule; retention only in the statutory cases (legal duty, research, transfer, exclusive controller use with anonymization).

    The excuse ‘it was only a dead contract’ already showed up in the Isac case. The retention clause needs a term and a basis, not a forgotten S3 folder.

    Open sourceLaw 13.709/2018, art. 15
  27. 28
    LGPD

    ANPD Resolution 2/2022: small size is not a licence for an empty DPA

    Res. 2/2022 eases duties of small agents (impact report, DPO), but does not waive legal basis, security or data-subject rights. High risk and large-scale processing remove the benefit.

    A tech startup that calls itself ‘small’ and processes data of thousands of users has probably left the flexibility. The large-customer contract will still demand a DPO.

    Open sourceANPD Resolution 2/2022
  28. 29
    PJ contracts

    Front-page checklist of the PJ contract while first instance instructs

    With the national stay lifted in first and second instance (Theme 1.389), what enters the case now is evidence: personal nature, exclusivity, hours, the taker’s tools, subordination.

    Tip: reread the PDF today. If the contractor only uses the company email, only serves one client and clocks in, the CNPJ on the cover will not survive instruction.

    Open sourceSTF 18 Jun 2026 (Theme 1.389)
  29. 30
    NDA and playbook

    NDA playbook: what a review against the internal standard must find

    The review assistant announced on 25 Mar compares the agreement to the house playbook. Without an internal standard (term, forum, data, residual, residual IP, residuals), AI only summarizes the PDF.

    Build the playbook before the tool. Five minimum positions: term, forum, personal data, residual IP and what happens at termination.

    Open sourceDocusign IR 25 Mar 2026

Let's Talk

Your company's future starts here

Schedule a strategic conversation and discover how we can drive your business growth with legal security.

WhatsAppEmail
(11) 94198-8484contato@costalaw.com.br@costalaw.adv