Law n° 14.195/21 (Business Environment Law), passed on August 26, 2021, represents a significant evolution towards reducing bureaucracy and improving the business environment in Brazil.
Among the valuable changes introduced by this law, we will briefly discuss the new wording of article 146, paragraph 2, of Law No. 6404/76, the Brazilian Corporations Law, which allowed, subject to specific requirements, the election of individuals residing or domiciled abroad to occupy the position of member of management, both in joint-stock companies and in limited liability companies, the latter when ruled in a supplementary manner by the Corporations Law. Until the approval of the referred law, such individuals residing abroad could only be part of the Board of Directors:
““Art. 146. Only natural persons as members of the administrative bodies can be elected.
(…)
§2. The investiture of a manager residing or domiciled abroad is subject to the constitution of a representative residing in Brazil, with powers to receive up to at least 3 (three) years after the end of the manager’s term of office:
I – summons in actions brought against him based on the corporate legislation; and
II – summons and subpoenas in administrative proceedings initiated by the Securities and Exchange Commission of Brazil, in the event of his holding a management position in a publicly-held company.
This change was very well received, especially by international companies that now have the option to elect for management positions natural persons who have a residence abroad, including in the place where the headquarters of the partner / controlling shareholder is located.
It is worth mentioning that the Normative Instruction DREI/ME no. 112, of January 20, 2022, brought more legal security on the subject by incorporating, in article 13, the change promoted by the Business Environment Law:
“Art. 13. In the case of the appointment of a Brazilian or foreigner not residing in Brazil to the position of administrator (member of the board of directors or the board of executive officers) in a joint-stock company, investiture will be conditioned to the appointment of a representative residing in the country, under the terms of § 2, of art. 146, of Law nº 6,404, of December 15, 1976. “
It should be noted that this innovation should also meet the needs of a globalized world and the transformations resulting from the Covid-19 pandemic, among them remote work.
Furthermore, this change may increase the flow of foreign investments in Brazil. The possibility of appointing members of management who are resident/domiciled in the location of the controlling company’s headquarters, for example, and, thus, closer to the group’s culture, can provide foreign groups with greater security and, consequently, lead to an increase in their investments in Brazil.
However, we cannot lose sight of the fact that, although the rule is in force and represents a significant innovation, we still have to face some practical issues to make it effective, such as, for example, the non-existence of the competent event in the REDESIM system “DBE”.
The Brazilian IRS has already determined the creation of the events of inclusion/alteration of the Partners and Administrators Chart for the companies that have directors domiciled abroad (070 – Administrator resident abroad). However, we are still in the system’s adaptation phase and waiting for its implementation.
In view of the above, although the Business Environment Law is already in effect and represents a significant advance to modernize the business environment, reducing bureaucratization and barriers for companies, in practice, and in what concerns the administrator residing abroad, the law is still dependent on measures and adjustments to become effective, as informed above.
For more information about other innovations brought by Law No. 14.195/21, we suggest checking the publication made by GTLawyers in October 2021, containing brief additional considerations about the legislation in reference.
Article prepared by Fernanda Lefrève Buff, lawyer at GTLawyers and revised by partner Priscila Conde. For more information, please contact the phone (11) 3504 7600 or e-mail pconde@gtlawyers.com.br.
Dear all,
It is with great satisfaction and pleasure that we would like to inform you that on February 21st, 2022, we have completed the process of acquiring the company PLURIE REGULATORY SOLUTIONS.
Plurie was founded by Mariana Lima in 2008 after a highly successful career working in the regulatory affairs area at Syngenta. Since then, her company has grown significantly not only in terms of its service portfolio, but also in terms of being able to serve clients from different regions. Today, Plurie has around 25 employees working for clients in Brazil and abroad. Plurie offers more than 25 different types of regulatory services to help clients select and define the best regulatory strategy, planning, execution, project management and monitoring with the main regulatory bodies in Brazil (MAPA, ANVISA and IBAMA). Plurie also assists its customers with mandatory studies such as tox, ecotox, e-fate, environmental licence (EIA-RIMA), and monitoring of environmental, efficiency and waste studies.
Both we at Staphyt as well as the Plurie team will continue to work and fulfil all the commitments made to our customers. In due course, the merger of the two companies will take place gradually and continuously, without jeopardising the projects and commitments assumed with our partners and customers.
The acquisition of Plurie is part of our project to offer our customers an enlarged, diverse, dynamic and experienced regulatory services team, always seeking excellence in our services, thus meeting the objectives of our customers and partners. We are proud to be one of the biggest Global regulatory team in the world, with around 85 employees providing services in Europe, Oceania and Latin America.
Best regards,
Fabíola Lara – Senior Regulatory Manager Latam
Mariana Lima – Senior Regulatory Manager
Luiz Antonio A Jose – Head of Operations Staphyt Brazil
*Send by Staphyt
On 26 August 2021, Law nº. 14,195/21, the Business Environment Law, was sanctioned, which has its origin in Provisional Measure No. 1,040/21.
Considering that such law aims at fostering the Brazilian economy, which is seeking recovery after the unfortunate consequences resulting from the COVID-19 pandemic, we have conducted a brief study on three issues that have an impact on corporate law, namely, the issuance of commercial notes by companies (corporations, limited liability companies and cooperatives); the possibility of a company having a manager resident abroad; and, the repeal of the provision that established limits on the liability of the company in the event of acts performed by its managers in excess of their powers.
Regarding the first point, commercial notes, it should be clarified, initially, that this is a credit instrument that was previously regulated only by Normative Instruction nº. 566, of July 31, 2015, of the Real Estate Securities Commission.
Law 14,195/21 governed commercial notes and provided, in article 45, that they were “a credit security not convertible into shares, freely negotiable, representing a promise to pay in cash, issued exclusively in book-entry form through institutions authorised to provide bookkeeping services by the Securities Commission”.
Moreover, with the advent of the Business Environment Law, some rules imposed by Normative Instruction nº. 566/2015 were relaxed, and the following became allowed: (i) issuance of the commercial note by all cooperatives; (ii) book-entry form; and, (iii) possibility of periodic payment of face value and interest, for example.
The Law also sets out the requirements that must be included in the constitutive instrument of the commercial note, as follows the name “Commercial Note”; the name or corporate name of the issuer; the place and date of issue; the issue number and the division into series (if any); the face value; the place of payment; the description of the guarantee in rem or as security (if any); the date and conditions of maturity; the interest rate; the amortization and yield payment clause (if any); the price index adjustment clause (if any); and, the amendments and rectifications (if any).
It should be noted that the law provides that the commercial note is an extrajudicial enforceable instrument, which may be executed regardless of protest, based on a certificate issued by the bookkeeping agent or central depository, and may be considered overdue in the event of default on the obligation stated in the term of issue.
Thus, we believe that the Economic Environment Law may bring about an increase in the circulation of these bonds, as a way of short-term financing for companies that do not wish to obtain bank financing, facilitating credit and reducing the costs involved. In addition, it will provide a reduction in time and cost.
Another change introduced by the Business Environment Law is the possibility of the company being managed by natural persons domiciled abroad.
Article 146, paragraph 2 of Law Nº. 6404 of 15 December 1976, the Corporations Law, is hereby amended to read as follows
“Art. 146. Only natural persons may be elected as members of management bodies.
(…)
§2. The investiture of a manager residing or domiciled abroad is subject to the constitution of a representative residing in Brazil, with powers to receive up to at least 3 (three) years after the end of the manager’s term of office:
I – summons in actions brought against him based on the corporate legislation; and
II – summons and subpoenas in administrative proceedings initiated by the Securities and Exchange Commission of Brazil, in the event of his holding a management position in a publicly-held company.
It is of utmost importance and essential to observe the requirement listed above for the regular and valid tenure of the administrator residing abroad.
This is a great innovation since, until the enactment of the Law under analysis, the positions of Directors could only be occupied by individuals residing in Brazil.
Finally, we make brief considerations on the revocation of the sole paragraph of article 1,015 of the Brazilian Civil Code, which limited the liability of the company in case of acts performed by its managers in excess of their power.
The measure aims to protect third parties in good faith who contract with the company, since the aforementioned paragraph established hypothesis under which the company could claim not to be obliged to comply with the commitments assumed by the directors, as follows
“Article 1.015. When the articles of association are silent, the managers may perform all acts pertaining to the management of the company; if the object of the company is not the same, the encumbrance or sale of real estate assets depends on what the majority of the partners decide.
Sole Paragraph. The excess on the part of the managers may only be opposed to third parties if at least one of the following hypothesis occurs
I – if the limitation of powers is registered or recorded in the company’s proper register
II – if it is proven that it was known to the third party
III – in the case of an operation evidently foreign to the company’s business”.
Thus, with the exclusion of the sole paragraph of art. 1015 of CC, even if the administrator has acted with excess, the company will be bound to what was adjusted by him.
It should be clarified that it will be up to the company to rule out the good faith of the third party in order to allege the excess of mandate, proving that the third party was aware of the excess of mandate, that the powers of the administrator and/or its limitations were duly registered in.
documents that could be obtained by the third party and that the nature of the operation was strange to the corporate purpose of the company.
In view of the above, although the rule is recent, and still subject to questions regarding the changes promoted, we believe it is an important milestone to modernize the business environment, being able to reduce the bureaucracy that permeates the companies, as well as to encourage the economic heating so desired after the Covid-19 pandemic.
GT Lawyers – October 19, 2021
Article prepared by Fernanda Lefrève Buff, lawyer at GTLawyers and revised by partner Tamy Tanzilli. For more information, please contact the phone (11) 3504 7600 or e-mail ttanzilli@gtlawyers.com.br.
On July 17, 2021, an important decision for entrepreneurs was published by the 4th Federal Court of Campo Grande regarding Brazilian taxation and the General Data Protection Law (“LGPD”). In the discussion regarding the expenses incurred by the company for the implementation and adjustment to the LGPD, the court decided that this type of expense had the nature of input for the purpose of PIS/ COFINS credit under the non-cumulative regime.
It is worth recalling that with the creation of the non-cumulative regime of PIS/COFINS (Laws 10,637/2002 and 10,833/2003), taxpayers are allowed to deduct these credits from their contributions calculated on the basis of goods and services used as input in the provision of services and in the production or manufacture of goods or products intended for sale, including fuels and lubricants (Article 3, II, § 3, I).
Given the numerous interpretations regarding the scope of the term ‘input’, the judiciary has ruled and the STJ has decided (Special Appeal 1.221.170/PR, judged on 2/22/2018), under the repetitive appeal system, that the definition of ‘input’ should be sought in light of the essentiality or relevance of the item for the development of the taxpayer’s business – including when such relevance arises from a legal imposition.
In this context, the current investment of companies to adapt to the LGPD appears to be a mandatory expense, imposed by the legislator and moreover, sanctioned in case of non-compliance with the legal provisions. It seems clear, therefore, that the relevance of this expense is in fact fully proven and characterized and that failure to comply with the standards of the LGPD constitutes a barrier to the company’s activities and will involve a substantial loss of credibility.
Indeed, given the penalties that will be imposed as of August 2021, this legal obligation of adequacy becomes inevitable. In addition to these sanctions, non-compliant companies will lose competitiveness in the market, especially in international negotiations and transactions, given that many countries are already far ahead in terms of data protection compliance.
Thus, it appears that there are solid grounds for characterizing the expenses incurred to comply with the LGPD as an input for PIS/COFINS purposes (non-cumulative tax regime), although the decision discussed above still requires confirmation given that it is a decision of first instance.
GT Lawyers – August 12th, 2021
Article prepared by Ana Márcia, lawyer at GTLawyers and reviewed by partners Anne Brunschwig and Estevão Gross. For more information, please contact the telephone (21) 2540 7282 or e-mail abrunschwig@gtlawyers.com.br.
Companies accumulate, on a daily basis, large volumes of personal data customer records, employee documents, supplier information, marketing databases, contracts, invoices, access logs, service records and many others. This storage, though often necessary for business operations, cannot be unlimited.
Both the Brazilian General Data Protection Law (LGPD) and the European Union General Data Protection Regulation (GDPR) share a common premise: personal data must be kept only for as long as necessary to fulfil the purpose that justified its collection, unless there is a legal basis permitting its retention for a longer period.
In practice, this is one of the most sensitive aspects of privacy governance. Although the rule is straightforward, its application requires careful assessment, since data protection legislation generally does not establish a single, universal retention period for each type of personal data. In this context, companies are responsible for defining their own criteria, taking into account the purpose of the processing, legal or regulatory obligations, limitation periods, operational needs and risks to data subjects.
Why does data retention matter?
Excessive retention of personal data increases legal, operational and security risks. The longer a company holds personal data without a clear processing need, the greater its exposure in the event of a security incident, unauthorized access, use of outdated information, data subject requests or scrutiny by regulatory authorities.
In this context, retention and disposal rules should not be seen merely as a formal privacy requirement. On the contrary, they form part of sound information governance and help reduce concrete risks for the company.
A well-structured retention policy enables companies to:
– define retention and disposal periods;
– reduce the unnecessary storage of personal data;
– facilitate responses to data subject requests;
– reduce security risks;
– demonstrate legal and regulatory compliance.
LGPD and GDPR: retention, deletion and legal exceptions
The LGPD and the GDPR adopt a similar logic: personal data must be retained only for as long as it is necessary for the purpose that justified the processing. Once that purpose has been fulfilled, the general rule becomes the deletion or anonymisation of the data, unless there is a legal basis authorising its continued retention
In Brazil, the LGPD permits the retention of personal data in specific circumstances, such as compliance with a legal or regulatory obligation, research by a research body, transfer to third parties in accordance with the law, or exclusive use by the controller, provided that the data is anonymised wherever applicable.
Similarly, the GDPR allows retention where necessary, for example, for compliance with a legal obligation, the establishment, exercise or defence of legal claims, or for certain purposes of public interest, research, statistics or archiving, provided to the applicable safeguards.
In this context, the key point is that companies must not retain personal data indefinitely or merely “as a precaution”. Compliance therefore depends on the ability to define, document and consistently apply clear criteria for retention and disposal, aligned with legitimate legal, regulatory and business needs.
Guidance from data protection authorities
Data protection authorities generally require companies to define retention periods based on necessity and proportionality criteria. In other words, it is not sufficient to retain data because it “might be useful in the future”: it is necessary to objectively justify why that data is still needed.
The Information Commissioner’s Office (ICO), the UK data protection authority, advises organizations to be able to justify how long they retain personal data, to establish standard retention periods wherever possible, to periodically review stored information and to delete or anonymize data that is no longer needed.
Complementarily, the French data protection authority (CNIL) also provides practical parameters on the subject. In the context of commercial management, for example, the CNIL indicates that customer data used for prospecting may be retained during the commercial relationship and, after it ends, generally for up to three years. Data relating to potential customers may generally be retained for three years from the date of collection or from the date of the last contact initiated by the potential customer.
This guidance does not replace a case-by-case analysis, but serves as a relevant reference for companies that are structuring their internal retention schedules.
Carrefour and the risks of excessive retention
The Carrefour case clearly illustrates the risks associated with excessive retention of personal data.
In 2020, the CNIL imposed a fine of EUR 2.25 million on Carrefour France for several GDPR violations, including excessive data retention. Among other findings, the authority determined that the company had retained inactive customers’ data for longer than necessary and had kept copies of identity documents submitted in connection with data subject requests for longer than was justifiable.
This case demonstrates that authorities do not assess retention periods merely in the abstract. In practice, they expect companies to implement effective deletion routines, document their retention criteria and ensure that their internal systems actually reflect the privacy policies and notices made available to the public.
The role of Controllers and Processors in data retention
The obligations relating to retention may vary depending on whether the company acts as a controller or processor of personal data. In this context, Controllers and Processors assume distinct, albeit complementary, responsibilities.
Controllers are generally responsible for defining the purposes of processing and the applicable retention periods. Processors, in turn, must process personal data in accordance with the documented instructions of the controller and, at the end of the service provision, return, delete or otherwise dispose of the data, unless there is a legal obligation justifying its retention.
Indiscriminate retention, in this scenario, may generate risks for both parties. For the Controller, retaining data without criteria makes it difficult to control the information lifecycle and may increase regulatory exposure. For the Processor, on the other hand, retaining data beyond what is necessary may increase security risks, contractual liability and questions regarding adherence to the instructions received.
For this reason, contracts involving personal data processing must clearly set out what will happen to the data at the end of the contractual relationship, including return, deletion, anonymisation, retention due to legal obligation and, where applicable, evidence of disposal.
What companies should do
To manage retention and disposal risks, companies should adopt practical and documented measures, including:
– mapping the main categories of personal data processed;
– identifying the purpose and legal basis for each processing activity;
– defining objective retention periods or criteria;
– linking retention periods to legal obligations, limitation periods and legitimate business needs;
– implementing secure deletion or anonymisation routines;
– reviewing legacy databases and inactive records;
– ensuring that privacy notices and internal policies reflect the practices actually adopted;
– including retention and deletion clauses in contracts involving personal data processing;- documenting exceptions where data must be retained for legal, regulatory or litigation-related reasons.
Data retention, though often underestimated, is one of the central elements of data protection compliance. Retaining data for longer than necessary increases legal, security and reputational risks. On the other hand, deleting data too early may compromise compliance with legal obligations or the company’s ability to defend its rights.
Given this, the solution does not lie in adopting a generic retention period for all data, but in structuring a retention and disposal policy supported by a retention schedule, clear internal responsibilities and practical deletion or anonymisation procedures.
At GTLawyers, our data protection team assists companies in drafting and implementing retention and disposal policies, reviewing data processing contracts, mapping legal retention obligations and aligning internal practices with the LGPD, the GDPR and other international privacy standards.
In recent years, international trade has been marked by significant instability, with political and economic shifts abruptly altering the rules of the commercial landscape. The United States’ protectionist and aggressive tariff policy, together with the impact of geopolitical conflicts on commercial transactions – such as the war in Ukraine and the ongoing conflict in Iran – provide a clear illustration of this dynamic.
This instability naturally affects the ability of business operators engaged in international activities to plan their operations and make their investments with a minimum level of security over a longer time horizon.
It is precisely in this context that the importance of the recent signing, in January 2026, of the Partnership Agreement between Mercosur and the European Union becomes evident.
This importance stems from the creation of a large economic area: more than 700 million people and potential consumers, and the elimination of customs duties on over 90% of intra bloc trade. Moreover, the agreement provides for a stable framework for economic relations, as both tariff and non tariff measures must comply with the rules set out therein. Likewise, in the field of services, the opening of the government procurement sector has been established.
New trade flows are expected to be created, encouraging the development of global value chains within the bloc. In the industrial sector, in which Mercosur countries are more protectionist, many of the high customs barriers will be eliminated, notably in the automotive, machinery and pharmaceutical sectors. Investments in mining, including in minerals that are critical for the energy transition, will be protected against certain interventionist measures, such as specific types of export taxes.
Likewise, opportunities for access to the European market expand, especially for agricultural products produced in the Mercosur region. There will be a clear trend toward increased European participation in Mercosur’s export market. In addition to these opportunities comes the challenge of adopting production methods that are more consistent with European requirements, which are generally more stringent in sanitary and environmental matters. On this point, it is important to note that the agreement does not eliminate these requirements, it merely frames them and obliges them to comply with the agreed provisions.
The Partnership Agreement therefore stands out as a contrasting element in the current context. In a more protectionist world, it reduces and even eliminates many trade barriers. In an unstable world, it provides greater legal certainty by establishing rules that States must observe in their economic regulations. It will now be up to business operators to make the most of this broad path that opens before them, and to lawyers to guide them along the safest routes to follow.
Investing in Brazil: opportunities in the financial market and legal and tax aspects for international investors
The Legal Committee of the France‑Brazil Chamber of Commerce (CCIFB‑SP) will hold an in‑person meeting on May 7, dedicated to French and Brazilian executives and entrepreneurs interested in gaining a deeper understanding of Brazil’s investment environment.
The event will provide a comprehensive overview of:
- How the Brazilian financial market operates
- The main instruments available to foreign investors
- Legal, tax, and regulatory issues that influence decision‑making
- Best practices for structuring investments securely and efficiently
The session will be moderated by Tamy Tanzilli, Founding Partner of GTLawyers and Deputy Leader of the CCIFB Legal Committee, who will share her experience in cross‑border transactions and advising French companies in Brazil.
Confirmed speakers:
- Gunnar Viana, CEO – TRAAD
- Estevão Gross, Partner of the Tax Department – GTLawyers
- Leonardo Cappa, Économiste‑en‑chef – TRAAD
- + two additional market guests
May 7 (Thursday)
9 a.m. to 11 a.m. (welcome coffee and networking at 8:30 a.m.)
CCIFB-SP – Alameda Itu, 852 – 19º andar – Jardins
If you have any questions: secretarianacional@ccfb.com.br
Register via the link: Evento presencial | Comissão Legal: Investir no Brasil – oportunidades no mercado financeiro e aspe…
The growing importance of the Data Protection Officer (DPO) within corporate environments highlights the need to ensure the independence and impartiality of this role . Because the DPO performs advisory, monitoring, and reporting functions — including on sensitive matters that may diverge from the organization’s interests — the proper performance of these duties requires the ability to act freely and without undue restriction.
In this context, identifying potential conflicts of interest involving the DPO is essential. A conflict of interest arises when personal, professional, or institutional interests interfere with a person’s ability to act objectively and impartially. In the case of the DPO, such a conflict may occur when the officer simultaneously holds positions that influence decisions regarding the purposes or means of personal data processing, or when their activities are subordinated to organizational interests that are incompatible with their duty to advise, monitor, and report independently.
Incompatibility of Functions
Guidance issued by the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) indicates that certain roles are incompatible with the function of a DPO. These include executive management positions and roles in human resources, information technology, marketing, or finance, as these functions involve strategic decision-making that may place the company’s commercial interests in opposition to the fundamental right to personal data protection.
For example, a DPO who also works in marketing may hesitate to report security incidents out of concern for potential reputational damage to the company. Situations like this highlight the importance of the principle of independence, which is expressly established under the GDPR and reflected in the guidance of the Brazilian National Data Protection Authority (ANPD).
Although Brazil’s General Data Protection Law (LGPD) does not explicitly establish the principle of independence, Resolution CD/ANPD No. 18/2024 reinforces the requirement that the DPO must perform their duties impartially and without conflicts of interest. Under this resolution, the DPO is responsible for declaring any situation that may give rise to a conflict of interest, while the data controller must prevent and remedy such situations, including by (i) refraining from appointing the professional, (ii) adopting measures to eliminate the risk, or (iii) replacing the DPO if the conflict persists.
Best Practices to Prevent Conflicts of Interest
Adopting best practices is essential to ensure the independence and impartiality of the DPO. Among the key measures recommended by the GDPR and Resolution CD/ANPD No. 18/2024 are: (i) ensuring hierarchical separation between the DPO and the departments responsible for decisions regarding data processing; (ii) establishing direct reporting lines to senior management; and (iii) providing adequate human, technological, and financial resources to enable the DPO to properly perform their duties.
Additional measures include formalizing internal policies that clearly regulate the accumulation of functions and require periodic declarations of absence of conflicts of interest, creating privacy committees, ensuring ongoing training, and establishing secure communication channels with senior management.
Practical Cases and International Sanctions
Conflicts of interest may lead to significant sanctions within the European Union. In Belgium, for instance, a company was fined €50,000 under Article 38(6) of the GDPR after authorities found that the DPO held conflicting roles by simultaneously serving as Director of Audit, Risk, and Compliance. A similar case occurred in Germany, where a company was fined €525,000 because the same individual acted as both DPO and director of two service provider companies within the same corporate group. In February 2023, the Court of Justice of the European Union (CJEU) examined Case C-453/21, which addressed whether holding the positions of both chair of the workers’ council and DPO constituted a conflict of interest. The Court concluded that such overlap could undermine the independence of the DPO and left it to national courts to assess the specific circumstances of each case. In Brazil, although no specific precedents have yet been established, a violation resulting from a conflict of interest may lead to the application of the sanctions provided for in Article 52 of the LGPD.
Conclusion
The role of the DPO is strategic for corporate governance and for fostering a culture of privacy, going beyond a mere legal requirement. To perform their duties with independence, integrity, and effectiveness, it is essential to understand the obligations established under the GDPR, the LGPD, and Resolution No. 18/2024. Building robust privacy governance depends not only on legal rules but also on an organizational culture that values transparency and prevents conflicts of interest, while ensuring the technical autonomy of the DPO.
GTLawyers provides specialized support in the implementation and improvement of privacy programs, including ongoing legal assistance to DPOs and DPO as a Service solutions. Its services aim to ensure regulatory compliance, promote best governance practices, and mitigate risks, while preserving the independence and credibility of the DPO as a key pillar of institutional trust.
After more than 25 years of negotiations, the European Union (EU) and Mercosur signed, on 17 January 2026, a trade agreement providing for the creation of one of the world’s largest free trade areas. Together, the two blocs represent over 700 million consumers and account for approximately 30% of global Gross Domestic Product (GDP). This agreement marks a major milestone in economic relations between Europe and South America, with direct implications for European companies seeking to enter or expand their presence in Brazil.
The agreement provides for the gradual reduction or elimination of import and export tariffs on bilateral trade between the two blocs. It also establishes common rules in areas such as trade in industrial and agricultural goods, investment, regulatory standards and sustainable development.
From a trade perspective, Mercosur countries have committed to eliminating approximately 91% of the tariffs applied to European products, while the European Union plans to remove around 92% of the tariffs imposed on South American goods. In many sectors, this liberalisation will be phased in and may take place over a period of up to 15 years, allowing for a gradual adjustment of markets.
For European investors, and particularly for companies with existing operations in Brazil or plans to expand their presence there, the agreement is of particular significance. According to data from the European Commission, Brazil accounts for over 80% of European imports originating from Mercosur and around 79% of the South American bloc’s exports to the European Union.
In this context, economic studies suggest that the agreement could stimulate an increase in foreign investment in the country, notably through the reduction of import costs for machinery, industrial equipment, pharmaceuticals, chemicals, wines, cheeses and other European goods that are currently subject to high tariffs on the Brazilian market.
Another area of interest for foreign companies is the opening of public procurement markets. The agreement creates conditions enabling European companies to participate in public tenders in Mercosur countries, including at the Brazilian federal level. It also seeks to ensure more secure access to raw materials considered strategic for the energy and digital transitions, such as niobium, for which Mercosur is the European Union’s main supplier.
From a regulatory standpoint, the agreement reaffirms that only products complying with the European Union’s sanitary and food safety standards will be allowed to enter the European market, thereby preserving the bloc’s regulatory framework. This is particularly relevant for European companies already accustomed to operating under these standards.
Beyond economic aspects, the treaty also incorporates commitments relating to sustainable development, implementation of the Paris Agreement, environmental protection, labour rights and responsible business conduct. These elements reflect the intention to align trade liberalisation with shared values and standards between the two blocs.
Despite its signature, the agreement has not yet entered into force. In order to produce full legal effects, it must be ratified by the national parliaments of the Mercosur countries as well as by the European Parliament. This process is expected to be politically sensitive, particularly in certain EU Member States such as France. In a recent development, on 21 January, the European Parliament decided to refer the agreement to the Court of Justice of the European Union. Although this decision does not have suspensive effect, it effectively prevents immediate application of the agreement and may delay its implementation.
At the same time, the possibility of provisional application of certain parts of the treaty is being discussed, in particular those relating to tariff reductions, which could allow some of its economic effects to materialise earlier.
For companies and investors with interests in Brazil, close monitoring of the ratification and implementation process will be essential in order to assess opportunities, risks and medium- to long-term strategies.
Written by Eduardo Grandchamp – French Team
Summary: IT Governance plays a central role in mitigating algorithmic biases in AI by implementing processes and practices that are ethical, auditable, and transparent. However, the major challenge is balancing technological innovation with data protection and the rights of data subjects. When implemented effectively, these practices reinforce legal and ethical compliance, promoting equity and social responsibility without undermining the competitiveness of companies.
Keywords: IT Governance; Artificial Intelligence; Algorithmic Bias.
The growing use of algorithms in the processing of personal data by artificial intelligence (AI) has been a central topic in debates on ethics and social implications around the world. Although they offer significant efficiency, these algorithms often reproduce social biases embedded in training data (i.e., information used for their development), resulting in systemic discrimination. In automated credit granting decisions, for example, AI can favor already privileged groups, reinforcing pre-existing inequalities.
It is in this context that information technology (IT) governance plays a fundamental role in mitigating these biases. Through the adoption of ethical practices and robust mechanisms for supervising AI operations, it is possible to promote a more transparent, equitable, and responsible use of algorithms, minimizing risks and protecting the rights of individuals guaranteed by the laws of various jurisdictions and favoring fairer automated decisions.
What are algorithmic biases and what are the related ethical implications?
Algorithmic biases are distortions in the results of AI systems due to prejudices present in the data used to train them. In other words, if the historical data used to train an AI system is biased towards a particular racial or socioeconomic group, the algorithm is capable of reproducing that bias.
A classic example occurs in recruitment processes: when an algorithm is trained with data that favors candidates with a certain profile, it may disregard talent from underrepresented groups, perpetuating discrimination. In this regard, a study conducted in 2022 using ChatGPT 3.5 revealed that names associated with Black candidates were less likely to be selected compared to names of white or Asian candidates, reinforcing inequalities in the labor market.
In this sense, it is essential that companies seek not only broader data collection, with representativeness in data sets, but also implement solid IT governance to combat algorithmic bias, as will be analyzed below.
IT governance in combating algorithmic bias and the difficulties of its implementation
Algorithmic bias can be mitigated through the implementation of robust IT governance, which involves adopting a set of processes, policies, procedures, and practices for risk management, ensuring the ethical use of data, and improving the performance and security of technological operations.
This implementation can be achieved by creating ethics committees dedicated to AI, human supervision and continuous monitoring of training data, mainly through audits, as well as by hiring data professionals from different backgrounds to promote diversity.
On the other hand, the task of making AI systems explainable and auditable is not easy, as it involves several technical and operational challenges. First, due to the complexity of AI models themselves, especially those based on deep learning. Secondly, because complete and accessible documentation of algorithm development requires specific technical knowledge, and many companies lack internal specialists with the necessary expertise and even sufficient funds and time to hire external specialists.
In the same vein, transparency in the disclosure of information to impacted stakeholders can be more complex when personal data is used by companies that have trade secrets. The Brazilian General Data Protection Law (LGPD), as well as the European Union’s General Data Protection Regulation (GDPR), for example, establish that data processing must be carried out transparently so that data subjects are fully aware of how their information is being used. Compliance with such legal requirements, in this context, could compromise the protection of trade secrets.
In addition, concerns about the use of AI have been the subject of concern in several countries: in the European Union, the AI Act came into force this year, whose main objective is to establish a legal framework for the development, placing on the market, entry into service and use of AI systems. The AI Act seeks to simultaneously guarantee the protection of fundamental rights and support innovation, establishing more or less stringent compliance requirements depending on the level and risk associated with the use of AI, in addition to stipulating that developers must use representative data and conduct regular audits to ensure transparency.
Similarly, the Algorithmic Accountability Act is currently being debated in the US Congress, proposing that companies using AI in high-risk sectors be required to conduct regular audits. In Brazil, Bill N° 2.338/2023 is also pending, focusing on security, transparency, and the protection of fundamental rights during the use and development of AI.
It should be noted, therefore, that despite the considerable challenges involved in implementing IT governance, this measure is essential for the secure use of algorithms and, above all, for striking a balance between innovation, ethical responsibility and compliance with current and future laws on the subject.
Conclusion
The use of algorithms in the processing of personal data has been growing steadily, generating numerous debates about ethics and social implications as they reproduce social biases embedded in training data.
In this scenario, the implementation of robust IT governance is necessary not only to promote sustainable and inclusive development, but also to protect the rights of individuals.
Although there are considerable challenges, measures such as audits, diversity in teams, and the creation of ethics committees ensure that automated decisions will be fair and comply with the LGPD, GDPR, AI Act, and future AI regulations in Brazil and the United States, without compromising business competitiveness.
Article originally published in the magazine “Fronteiras Digitais – Perpespectivas Multidisciplinares em Cibersegurança, Privacidade e Inteligência Artificial” (Digital Frontiers- Multidisciplinary, Privacy and Artificial Intelligence), 2025 edition, produced by Brazil- Canada Chamber of Commerce (CCBC) and the National Association of Data Privacy Professionals (APDADOS), p. 44..
Camila Lisboa Martins – cmartins@gtlawyers.com.br
Jessica Ferreira – jferreira@gtlawyers.com.br
