Brazil ICT Government Data
Brazil allows secure, in-country cloud services for classified government data, creating opportunities for certified providers meeting strict security rules.
On October 7, 2025, Brazil’s Institutional Security Office of the Presidency (GSI/PR) issued Normative Instruction No. 8/2025, authorizing the use of cloud computing for handling classified government information—a landmark shift in the country’s approach to digital governance. For the first time, “reserved” and “secret” data can be processed in private and community cloud environments, provided strict conditions for security, control, and auditing are met.
Under this new framework, all classified data must be hosted in data centers located within Brazilian territory, and cloud service providers must undergo prior certification, comply with stringent security standards, and be officially designated under Decree No. 7.845/2012. Public and hybrid cloud models remain explicitly prohibited for classified information, and ultra-secret data continues to be restricted from any form of cloud processing. This regulation also replaces the previous Normative Instruction GSI/PR No. 5/2021, which had entirely prohibited the use of cloud services for classified data, reflecting a more modern, nuanced approach to secure digital operations.
The instruction clearly delineates the responsibilities of contracting agencies and service providers and takes immediate effect upon publication in Brazil’s Official Gazette. It aligns with the broader objectives of the National Information Security Policy (PNSI), reinforcing the government’s commitment to protecting state information, strengthening cyber resilience, and asserting digital sovereignty.
For cloud service providers, particularly U.S. firms with expertise in secure cloud solutions, this represents a high-value market opportunity. Companies with experience in data localization, secure cloud infrastructure, cyber resilience, auditing, and compliance can meet Brazil’s certification standards and gain access to a growing market for classified cloud services. The requirement to host data domestically and meet strict security protocols favors providers that can deliver robust, localized solutions, creating both a challenge and an incentive for international firms willing to invest in compliant operations in Brazil.
By successfully navigating these requirements, U.S. companies can position themselves as key partners in Brazil’s secure digital transformation, helping the government modernize its IT infrastructure, safeguard sensitive data, and assert leadership in digital governance across Latin America. With Brazil’s focus on controlled, secure cloud environments, U.S. providers have an opening to expand commercial ties, demonstrate technical expertise, and drive innovation in a strategically important market.
For more information on opportunities for U.S. companies, please contact Patricia Marega Patricia.Marega@trade.gov, ICT Commercial Specialist, U.S. Commercial Service, São Paulo.