Proposed Brazil Bill Seeks Permanent Ban on Privatization of Public IT Companies

A new legislative proposal in Brazil’s Chamber of Deputies threatens to permanently shut down future privatization and merger and acquisition (M&A) opportunities within the state-controlled technology and data services sector. The bill, PL 6352/25, introduced by Deputy Natália Bonavides (PT-RN), seeks to classify public Information Technology (IT) companies as essential instruments of digital sovereignty, data privacy, and national security, making them exempt from future sale to the private sector. The proposal comes amid an intensifying national debate in Brazil over how to manage data access and infrastructure control against the growing power of international tech conglomerates.

The core argument put forward by proponents is that data is a strategic asset of national value, and privatizing the entities that manage government systems would lead to a loss of control over the "digital brain" of the state. The law explicitly mandates that essential government data infrastructure, such as the data centers used for processing and storing federal information, must remain on national territory and under the exclusive domain of public authority. This provision is aimed at ensuring that sensitive information on Brazilian citizens is not subjected to foreign legislation, such as the U.S. CLOUD Act, which could compel foreign-owned or operated data centers to turn over data.

A key mechanism of the proposed legislation is its "federalization" clause, which grants the federal government the power to intervene and assume the management of state, district, or municipal tech companies that are facing liquidation or sale. While this process would be conditioned on the local government’s agreement, it provides a means for the federal administration to prevent smaller public IT entities from being acquired by private interests, essentially limiting M&A opportunities down to the municipal level. For the private sector, the bill also mandates that any transfer of sensitive personal data held by the government to a private company must be preceded by a public consultation, adding a significant layer of bureaucratic oversight to outsourcing contracts.

The bill is currently under analysis in the Chamber of Deputies and marks the latest effort to shield key public IT assets. Similar legislation has previously targeted major federal firms such as Serpro (Serviço Federal de Processamento de Dados) and Dataprev (Empresa de Tecnologia e Informações da Previdência Social), which manage the nation’s most critical databases, including the national tax and social security systems. Foreign investors monitoring the political risk associated with large-scale privatization programs will watch the bill's progress through legislative committees, as its eventual approval could set a strict boundary on the scope of future state asset sales.

What it touches: The proposal directly impacts the long-term privatization thesis for state-controlled technology and data service companies in Brazil, particularly those involved in government data processing, such as Serpro and Dataprev. By defining these services as non-transferable state activities, the bill seeks to permanently remove them from the list of assets available for potential desestatization or private-sector partnerships.