Brazil Spends R$1.25 Billion to Secure Digital Sovereignty Over Public Health Data

The Brazilian government has begun a five-year, R$1.25 billion effort to secure full digital control over its public health system's most sensitive data, migrating billions of records to a national "sovereign cloud" infrastructure managed by the state-run Federal Data Processing Service, Serpro. The massive project, initiated by the Ministry of Health, will ultimately shift the entire database of the Sistema Único de Saúde (SUS)—Brazil's free, universal public healthcare system—from foreign-hosted servers to domestic ones under exclusive Brazilian legal jurisdiction. This strategic pivot signals a hardening of Brazil's stance on digital sovereignty and reduces its reliance on US-based cloud providers like Amazon Web Services (AWS), which previously hosted some of the health system’s data.

The decision moves critical national data out of the purview of foreign jurisdictions, ensuring all health information is governed solely by Brazilian law, particularly the Lei Geral de Proteção de Dados (LGPD), the country's comprehensive data privacy law. Serpro, one of the country's key state-owned IT enterprises, is spearheading the migration, which is projected to cost approximately R$250 million annually for five years. This initiative comes as part of a wider government push to consolidate critical public sector systems—from tax to social security—onto a nationally controlled cloud environment, aiming to strengthen data security and compliance.

The first phase of the operation is focusing on the Cadastro Nacional de Usuários do SUS (CadSUS), the national user registry that holds over 230 million patient records. This will be followed by the migration of the Rede Nacional de Dados em Saúde (RNDS), an interoperability network that contains over 5 billion health event records, representing the vast medical history of the country’s population. For the underlying technology, Serpro has contracted Huawei Cloud Stack to provide the technical platform for the new environment. However, both Serpro and the Ministry of Health have stressed that the Chinese firm is only supplying the architecture; Serpro maintains total operational control over the data, which will remain stored and processed exclusively in Brazil.

This national cloud strategy positions Brazil as one of the few nations worldwide with explicit digital sovereignty over its public health data. It resolves a long-standing tension regarding the security of citizen data stored under the legal frameworks of other countries, which had been the case when some health systems were hosted by hyperscalers. The success of this migration—particularly the seamless integration of billions of records without disruption to the SUS—will serve as a key test case for the future of Brazil’s national cloud infrastructure, with implications for all government data and its relationship with global technology partners.

What it touches: The Ministry of Health’s shift has direct implications for major US-based cloud providers (Amazon Web Services, Microsoft, Google) by removing them from a significant public sector contract, while at the same time solidifying Huawei's role as a major technology supplier for critical Brazilian government infrastructure.