Lula sanctions tax incentive for the creation of large data centers in Brazil

The Federal Senate approved Redata, which establishes the Special Tax Regime for Data Center Services. According to Luis Tossi, Vice President of the Brazilian Data Center Association, the most relevant aspect is not just the legislative approval, but the effect it will trigger in the sector.

Tossi commented in an interview with Olhar Digital that nearly 14 months passed from the announcement to the approval, a period during which there was a major backlog of projects in Brazil. This occurred because investors were waiting for the approval of this project to guarantee the necessary security for the large investments.

He added that only in the last two months, when the market began to question the viability of Redata, some projects were released, but only to maintain the natural growth of existing cloud services. With the approval now, the business landscape is changing significantly.

With Redata sanctioned, Tossi states that all international investors seeking locations with renewable energy and energy availability will return to focusing on Brazil. Although Brazil already holds more than half of the Latin American data center market, the high investment cost in the country represented a hurdle for attracting larger projects, especially those focused on training artificial intelligence models.

The executive explained that Redata reduces the tax burden on AI servers, allowing Brazil to enter the international competition, competing not only with its Latin American neighbors but also on the global stage. He highlighted that the previous investment cost was excessively high, which kept the country marginalized in this market.

Tossi emphasized that approximately 60% of cloud services used in Brazil are hosted outside the national territory. There is an expectation that Redata will help bring this data back to Brazil and attract a large volume of data centers dedicated to artificial intelligence training.

In practice, accredited companies will have tax suspension—including Import Tax, PIS/Cofins, PIS/Cofins-Importation, and IPI—for a period of five years when acquiring equipment. After fulfilling the stipulated obligations, this suspension turns into permanent exemption. The government estimates a fiscal waiver of R$ 5.2 billion in 2026, dropping to R$ 1 billion annually in the two subsequent years.

The main requirements imposed on beneficiary companies include the use of renewable or low-emission energy sources, the implementation of water efficiency in equipment cooling, a 2% investment in research and development (with 40% mandatory in the North, Northeast, and Central-West regions), and the allocation of at least 10% of computational capacity for the domestic Brazilian market.

Besides the issue of data location, Tossi pointed out two direct effects: the reduction in the cost of cloud services, which are currently among the most expensive globally, and the creation of jobs. A 50-megawatt IT data center generates between 3,000 and 6,000 jobs during construction and provides 3 to 5 direct jobs per megawatt during operation, adding 6 to 9 indirect jobs.

Brasscom classified the approval as a 'definitive step to ensure Brazil's prominence in the 21st-century global economy.' However, the approval was not unanimous; one day before the vote, the Coalition for Rights on the Net published a manifesto of opposition, as reported by Olhar Digital. The main argument raised was that the government 'inverted the order of things' by granting billions in tax exemptions before establishing clear guidelines on where and how such facilities could be built in Brazil.

Critical warnings included the high consumption of water and energy resources by data centers, the claim that installing servers on Brazilian soil does not result in technology or profit transfer to the country, the approval under emergency regime without public hearings, and the specific case of the TikTok data center in Caucaia, Ceará, which faces legal challenges due to impacts on water supply and the lack of prior consultation with the indigenous Anacé people.

A major data leak exposed millions of documents and raises concerns about potential impacts on Brazil. Often, when using platforms or services that require identity verification, the submitted data, such as scanned documents or selfies, is forwarded to third-party companies responsible for authentication.

The company IDScan, one of these service providers, was allegedly the victim of a major data breach, as reported by cybersecurity journalist Brian Krebs in an article published on his website on Tuesday, the 1st. The vast collection of this company's documents was reportedly exposed.

Although the leaked documents are known to belong to countries such as the United States and Canada, IDScan also provides authentication services for Brazilian documents and lists support for these types of documents.

The origin of the leak was identified on a dark web site called Nexus, which began disclosing access to a massive database. The criminals claimed to possess photos of over 153 million driver's licenses issued in the United States and Canada, in addition to about ten million identity documents, three million passports and travel documents, health cards, and access badges for government buildings.

To validate the authenticity of the material, the site presented samples, including documents belonging to Krebs and American authorities, such as US Secretary of Defense Pete Hegseth, and an assistant director of the FBI.

The connection between the leak and IDScan was established during the analysis of the exposed images. Each photo contained a date and time record. By comparing this data with his personal history, Krebs noted that the times coincided with moments when he had presented documents at locations equipped with IDScan readers.

The leak included versions of documents both front and back, as well as captures made under infrared and ultraviolet light, spectra used by validation equipment to check security elements invisible to the naked eye. Furthermore, the data extraction appeared to occur in real-time, with approximately 400,000 records entering the Nexus database in just 24 hours, while the criminals claimed to have collected data from the company over the course of a year.

After the publication of the report and confirmation that the FBI office in New Orleans initiated an investigation into IDScan, the Nexus site was taken offline.

Implications of the leak for security

Natalian Silva, spokesperson for IAM Brasil and cybersecurity expert, classified the incident as serious, given that technologies like those offered by IDScan are employed in processes considered critical. According to the expert, the leak goes beyond the simple exposure of documents, as it can generate inputs for fraud in financial, digital, and in-person services.

Silva detailed that previously captured and validated documents are particularly valuable to criminals, as they can be used in attempts to open accounts, apply for credit, improperly recover access, modify registration data, conduct social engineering, and create synthetic identities.

The expert made two important observations. Firstly, she stressed that such a leak does not imply that all processes using the documents are automatically compromised. She argued that robust validation must go beyond the mere presentation of the document image, needing to integrate signals such as proof of life, biometric comparison, device reputation, transaction context, behavior, and risk analysis. However, the incident considerably diminishes confidence in the document as isolated proof.

The spokesperson for IAM Brasil also pointed out an aggravating factor: although a password can be changed after a leak, personal characteristics such as face, date of birth, signature, and history cannot simply be replaced, which can lead to consequences for victims for many years.

Natalian Silva's second caveat was that the platform supporting Brazilian documents does not prove that Brazilian citizens' documents were actually leaked; this needs to be confirmed by the investigation. The technical processing capability indicates potential exposure but does not confirm the inclusion of Brazilian data in the incident.

Natalian Silva advised that companies using IDScan technology take immediate measures to verify which integrations and data are active with the partner platform, in addition to changing digital access keys (APIs), credentials, and passwords. She also recommended demanding clarification from the provider regarding the scope of the leak and, in the absence of security guarantees, temporarily suspending the submission of new information.

The expert concluded that this case reinforces the principle that outsourcing identity verification does not mean transferring responsibility. The contracting organization remains responsible for understanding the data flow, limiting its retention, assessing international transfer, monitoring security controls, and maintaining contingency plans for when a critical point in the chain of trust fails.

The Senate approved Bill 278/2026 on Tuesday (the 1st), which establishes an incentive regime for companies involved in installing or expanding data centers in Brazil. This document, previously approved by the Chamber of Deputies in February, was stalled among senators and is now being sent for presidential sanction.

The proposal was unblocked following a meeting between President Luiz Inácio Lula da Silva and Senate President Davi Alcolumbre (União Brasil/AP) last week. Senator Cid Gomes (PSB/CE) was appointed as the rapporteur on this matter in the Senate.

To expedite the implementation of this measure, Cid Gomes maintained the essence of the text approved by the Chamber, which was under the responsibility of Deputy Aginaldo Ribeiro (PP/PB), making only editorial adjustments. Since the Chamber had already approved the proposal, the changes do not require a re-vote by the deputies.

The bill creates what is known as Redata, a regime that provides for the suspension and subsequent reduction of tax rates to zero on information and communication technology equipment and products used in the installation or expansion of data centers. Taxes included are the Industrial Products Tax (IPI), Import Tax, and PIS/Cofins. The text also provides for a reduction in import tax if there is no equivalent domestic production.

This measure is intended to stimulate the placement of data centers in the country—structures considered strategic for the development of technologies such as artificial intelligence (AI), cloud computing, high-performance computing, and others. To receive benefits, companies managing data centers must ensure all necessary electricity for their operations through supply contracts or self-generation from renewable or low-emission sources.

The inclusion of the term 'low-emission' by the senators allows companies to also enter into energy agreements generated from natural gas. This requirement is one of the conditions for accrediting businesses under Redata.

More Details:

Ceará, a state that is the political home of both rapporteur Cid Gomes and Deputy José Gimaraes (PT/CE), has data center projects in the implementation stage. One of them is in Caucaia and is expected to require energy equivalent to the consumption of approximately 4.5 million households. José Gimaraes used the text of a temporary decree in the project, which came into force last year but expired on February 25.

The tax incentives are expected to reduce the costs of installing and expanding these facilities and will also promote new investments in the country's data center sector.