Brazil advances Redata and critical security

Brazil’s Senate approved PL 278/2026, which creates Redata and grants tax incentives for data centers, while the Institutional Security Office said CREDEN discussed a draft bill for a National Policy on Critical Infrastructure Security that is still being developed inside the executive branch. The two tracks are separate, but both affect the country’s digital and strategic infrastructure.

What did the Senate approve with Redata?

The Senate approved PL 278/2026 without changes to the substance of the version passed by the Chamber of Deputies, and the bill now goes to the president for signature. According to Agência Senado, the special regime suspends Import Tax, PIS/Cofins, PIS/Cofins-Importação and IPI for companies that set up or expand data centers in Brazil.

The Senate’s own coverage says the bill is aimed at data processing centers dedicated to storage, processing, and management of data and digital applications. It also presents the measure as part of the priorities of the concentrated workweek effort agreed by Luiz Inácio Lula da Silva, Davi Alcolumbre, and Hugo Motta.

How did Redata move through the political process?

The bill advanced after Lula secured Alcolumbre’s commitment to put it on the agenda for the concentrated workweek. Atitude Popular said Alcolumbre explained that the text reached the Senate on the last possible day for review in an earlier period, leaving senators without enough time to study it and preventing a vote before then.

The same coverage said the current commitment was to bring it to a vote during that week, while TNonline reported that Alcolumbre publicly said he would schedule the vote after a direct request from the president. In parallel, Agência Infra reported that Senator Cid Gomes was named rapporteur for PL 278/2026 in the Senate, a step described as key to clearing the way for a vote.

What incentives and regional changes does it introduce?

Redata includes differentiated incentives for data centers located in the North, Northeast, and Central-West regions, or in areas served by regional development agencies. According to Agência Senado, in those cases the minimum percentages for directing processing to Brazil and for investment commitments fall from 10% and 2% to 8% and 1.6%, respectively.

That design points to a policy of geographic decentralization and regional stimulus, according to the Senate’s official coverage. Rádio Senado also said the declared goal of the special regime is to encourage data center construction in Brazil through tax benefits.

What is the GSI discussing in parallel?

The GSI said CREDEN discussed, at its second annual meeting, a draft bill for a National Policy on Critical Infrastructure Security, but clarified that the text is still being developed within the executive branch before any possible submission to Congress. The body coordinates cyber defense and the protection of strategic infrastructure.

According to the statement, the proposal suggests a specific legal framework for protecting critical infrastructure in Brazil, with possible implications for cybersecurity requirements for operators of essential services. For now, the debate is still in the preparatory phase and has not formally reached the legislature.

How does this fit into the data and AI debate?

Alongside Redata and the critical infrastructure discussion, iG Economia described another regulatory agenda in Brazil for artificial intelligence and the LGPD. According to that coverage, the bill would require generative models to disclose a summary of the content used in training and to ensure compensation and an opt-out mechanism for copyright holders.

The same report says the text would amend the LGPD to insert Article 4-A, with requirements such as sector isolation, prior impact assessment, a record of retraining operations involving sensitive data, and certification where applicable. The result is a broader regulatory push, focused on data, AI training, and the location of digital infrastructure.