Foreign Startup in Brazil: Legal Setup and IP Protection
Brazil is the largest economy in Latin America and one of the top ten globally by GDP. It has a growing startup ecosystem, a large digital consumer base, and a legal system that, while complex, is navigable with the right structure from day one. Foreign founders who arrive without a legal foundation in place routinely spend the following 12 months unwinding problems that could have been avoided.
This guide covers the four structural pillars: corporate form, Brazil's Startup Law, trademark protection, and data privacy. At the end, a 90-day practical roadmap.
Corporate Form: Ltda. vs. S.A.
Two corporate forms dominate for foreign-founded startups in Brazil: the Ltda. (Sociedade Limitada) and the S.A. (Sociedade Anônima).
Ltda. is the default starting point. It is cheaper to incorporate, requires fewer ongoing disclosures, and does not need a board of directors. It is governed by a Articles of Association (Contrato Social) registered with the local Board of Trade (Junta Comercial). A Ltda. can have foreign partners; the structure is flexible and well-understood by Brazilian service providers, banks, and regulators.
S.A. is required if you intend to: issue shares to multiple investors in a structured round, list on a Brazilian exchange (now or in the future), or use certain investment vehicles that legally require the S.A. form. An S.A. involves more ongoing costs: annual meetings, published financial statements for larger companies, and audit requirements at scale.
Most foreign startups enter Brazil as Ltda. and convert to S.A. at the point of a Series A or when investor requirements mandate it. Conversion is legally straightforward but has tax and structural implications that require planning.
For both forms, a foreign entity holding shares in a Brazilian company must register with the Brazilian Central Bank (Banco Central) via the RDE-IED system, which records foreign direct investment. This is not optional and triggers ongoing reporting obligations.
Brazil's Startup Law: LC 182/2021
Brazil enacted its Startup Law (Lei Complementar 182/2021) in June 2021. For foreign founders, three elements are most relevant:
Definition. The law defines a startup as a company up to ten years old, with annual revenue up to R$ 16 million, and with an innovative character (broadly interpreted). Both Ltda. and S.A. can qualify. This definition unlocks specific legal treatments described below.
Investor protection agreements (Acordo de Investimento). The law formally recognizes investment agreements that include convertible notes, equity options, and vesting schedules — instruments that previously lacked explicit statutory support in Brazil. This matters for foreign investors familiar with SAFE notes or convertible instruments: the Brazilian equivalent now has a clearer legal home.
Regulatory sandbox. The law allows startups to apply for temporary exemptions from specific regulations for testing innovative products or services. This is relevant for fintech, health tech, and other regulated sectors. Each regulator (Banco Central, ANPD, ANVISA, etc.) administers its own sandbox programs under the law's framework.
LC 182/2021 also introduced equity option contracts (Contratos de Opção de Compra de Participação) that facilitate angel investment without triggering immediate tax consequences on the option grant — addressing a structural gap that had complicated early-stage deals.
Trademark Protection: INPI Before Launch
Brazil operates under an attributive trademark system governed by the LPI (Lei 9.279/1996): trademark rights arise from registration, not use. If you launch in Brazil without a filed trademark application, any third party can register your brand at INPI before you do — and legally own it in Brazil.
This is not a theoretical risk. Brand squatting is common in Brazil, particularly for foreign brands that generate buzz before registering locally.
File before you launch. The moment you know Brazil is a target market, begin the INPI filing process in the relevant Nice Classification classes. Priority is determined by the filing date, not the launch date.
Madrid Protocol option. If your trademark is already registered or applied for in a Madrid Protocol member country, you can designate Brazil through an international application filed via your home IP office. Brazil joined the Madrid Protocol on October 2, 2019. INPI will examine the designation under Brazilian law; the 18-month examination window applies.
Resident agent requirement. All foreign applicants at INPI must appoint a Brazilian-based trademark agent. No exceptions.
For a company entering Brazil, the minimum filing typically covers the classes corresponding to your core product or service. Expanding to adjacent classes later is possible but incurs additional fees and examination delays.
LGPD: Privacy by Design from Day One
Brazil's General Data Protection Law (LGPD, Lei 13.709/2018) applies to any company that processes personal data of individuals located in Brazil — regardless of where the company is headquartered. A U.S. or European startup that collects email addresses from Brazilian users is subject to the LGPD.
The LGPD requires a lawful basis for each processing activity. The most common bases for startups are: consent (freely given, informed, specific), legitimate interest (requires a balancing test), and contract execution (processing necessary to perform a contract with the data subject).
Data Protection Officer (DPO). The LGPD requires companies to appoint a DPO (called "Encarregado" in Portuguese). For smaller startups, this role is often filled by an outside legal or compliance provider. The DPO's contact information must be publicly available and reported to ANPD (Brazil's data protection authority).
Privacy notice and consent flows. Your website and app must have a LGPD-compliant privacy notice in Portuguese. Cookie consent flows must meet the standard; pre-ticked boxes are not valid consent.
Data incident response. ANPD Resolution No. 15/2024 sets the framework for data-incident notification when the incident may cause risk or harm to data subjects. The notification deadline runs from when the controller becomes aware of the incident — confirm the current deadline against the resolution before relying on a specific number, as this regulation has been updated.
Sanctions under the LGPD: warnings, fines of up to 2% of Brazilian revenue per year (capped at R$ 50 million per infraction), and mandatory publication of the violation. ANPD has been increasingly active in enforcement since 2023.
Digital Contracts in Brazil
Brazil recognizes electronic contracts under the Civil Code and the legal framework for electronic documents. A few specifics matter for foreign startups:
Consumer law applies. If you sell to Brazilian consumers (individuals purchasing outside a professional context), the CDC (Consumer Defense Code) applies regardless of what your terms say about governing law. This includes the right of withdrawal within 7 days of purchase for contracts concluded remotely — mandatory and not waivable by contract.
Portuguese-language terms. For consumer-facing products in Brazil, having terms of service and privacy notices in Portuguese is standard practice and expected by regulators. English-only terms do not adequately protect the company in consumer disputes.
Electronic signatures. Brazil's MP 2.200-2/2001 established the ICP-Brasil infrastructure for qualified electronic signatures. For most commercial contracts between companies (B2B), a standard digital signature (via DocuSign, ClickSign, or similar) is legally valid and enforceable. For real estate, public registry transactions, or certain regulated acts, ICP-Brasil qualified signatures are required.
90-Day Roadmap for Foreign Founders
Days 1–30:
- Engage a Brazilian lawyer to advise on corporate structure (Ltda. vs. S.A. decision).
- Begin incorporation at the relevant Junta Comercial; obtain CNPJ (Brazilian tax ID).
- Register foreign investment with Banco Central (RDE-IED system).
- File trademark application at INPI in the relevant classes.
Days 31–60:
- Appoint a DPO (Encarregado) and draft LGPD-compliant privacy notice in Portuguese.
- Open a Brazilian corporate bank account.
- Draft employment or service agreements for any Brazilian-based team members, under CLT or as contractors (estrutura PJ), with Brazilian legal review.
- Ensure your digital product has LGPD-compliant consent flows before Brazilian launch.
Days 61–90:
- Verify your terms of service include consumer-law-compliant withdrawal rights if you have B2C sales.
- Confirm INPI trademark filing status; respond to any formality requirements.
- Establish a tax compliance process with a Brazilian accountant (contador).
- Review any AI provider contracts for LGPD DPA clauses if you use third-party AI services that process Brazilian user data.
What Becomes Clear
Entering Brazil without legal structure tends to be a costly path for foreign founders. The four pillars — correct corporate form, Startup Law benefits, INPI trademark protection before launch, and LGPD compliance from day one — are not sequential. They run in parallel, and the sooner they are addressed, the lower the cost of correction.
Our practice covers digital law and creator economy, intellectual property, and digital contracts for foreign founders entering Brazil. See also: Trademark Registration in Brazil via INPI: Founder Guide.
FAQ
It can, in a limited and temporary way. But to operate continuously, hire employees, or issue Brazilian invoices, you need a local entity or subsidiary. Operating systematically without local incorporation creates regulatory and tax risk.
A Ltda. (Sociedade Limitada) is simpler and cheaper to incorporate and maintain, with fewer disclosure and audit requirements. An S.A. (Sociedade Anônima) is required to receive structured venture capital in Brazil and to issue shares. Most startups begin as Ltda. and convert to S.A. before a funding round.
Brazil's Startup Law (Lei Complementar 182/2021) created a specific legal framework for startups, facilitating angel investment, regulatory sandbox participation, public procurement, and equity option agreements. The law defines a startup as a company up to ten years old, with annual revenue up to R$ 16 million, and an innovative character.
The Madrid Protocol allows you to designate Brazil in an international application, but INPI will still examine the designation under Brazilian rules. If Brazil is a priority market, consider a direct national filing at INPI as well, for faster prosecution control. The two paths are not mutually exclusive.
The LGPD applies to any company that processes personal data of individuals located in Brazil, regardless of where the company is headquartered. ANPD sanctions include warnings, fines of up to 2% of Brazilian revenue (capped at R$ 50 million per infraction), and public disclosure of the violation. Beyond fines, reputational damage in a new market can be significant.
