Brazil: passenger data record

Data protection law and authority

The LGPD treats genetic or biometric data linked to a natural person as sensitive data (article 5, II) ¹. Its maximum simple fine is 2% of a private company's revenue in Brazil, capped at R$ 50,000,000 per infraction (article 52, II) ¹.

Article 4, III excludes processing done only for public security, national defence, state security or criminal investigation ¹. That processing must be governed by separate legislation with proportionate and strictly necessary measures (article 4, §1) ¹. The national authority issues technical opinions on these exceptions and may ask for data protection impact reports (article 4, §3) ¹.

Lei nº 15.352 of 25 February 2026 converted Medida Provisória nº 1.317 of 2025 ². It created the ANPD as a special autarchy linked to the Ministry of Justice and Public Security and added it to the list of regulatory agencies ². The authority's website uses the name Agência Nacional de Proteção de Dados ⁸.

API and PNR rules

ANAC Resolução nº 255 of 13 November 2012 sets rules for airlines to make Advance Passenger Information (API) and PNR data available ³. For international flights the data goes to migration, customs, health and agricultural control authorities (article 1, §1) ³. International API must be sent before take-off in the UN/EDIFACT PAXLST format (article 3, §1) ³.

Resolução nº 595 of 11 November 2020 extended the rules to domestic flights ³. Domestic data goes to competent authorities for aviation security and public health investigations (article 1, §1-A) ³. Domestic API and PNR annexes list fields such as identity data, CPF number, contact details, seat, baggage, booking codes, payment and check-in ³. The amendment took effect on 3 May 2021, with a six-month assisted implementation period ³.

Airlines that fail to send data, send it late or send it incomplete face penalties (article 6) ³. A justification accepted by the Polícia Federal for system outages may prevent penalties (article 6, §2) ³. The resolution text we opened sets no retention period ³.

Polícia Federal and the 2020 decision

The ANAC board vote on the 2020 amendment cites Decreto nº 7.168 of 2010, under which airline information is centralised by the Polícia Federal ⁴. The vote was signed by director Rafael José Botelho Faria on 10 November 2020 ⁴.

The vote says LGPD rules must be respected by airlines and public bodies, and that processing must be limited to its purpose ⁴. The proposal came from ANAC's airport infrastructure office under its 2019 to 2020 regulatory agenda ⁴.

Receita Federal risk analysis

Receita Federal's Projeto IRIS is a traveller risk management and selection system, according to a June 2019 report published by Enap ⁵. It combines an electronic baggage declaration, data cross-checks with the Polícia Federal and airlines, risk-scoring rules and facial identification of travellers selected for inspection ⁵. The report says it was operational at 14 international airports ⁵. The report names no supplier ⁵.

Automated gates and visas

GRU Airport in Guarulhos completed the first phase of installing 42 automated border control gates in partnership with Sita, as reported by Pedro Menezes in PANROTAS on 5 December 2025 ⁶. The report described the gates as using biometric technology ⁶. It gave no details on who holds the images, retention or funding ⁶.

Decreto nº 11.515 of 2 May 2023 revoked a 2019 decree and restored the earlier text of Decreto nº 9.199 of 2017 ⁷. Later decrees moved its entry into force, most recently to 10 April 2025 ⁷. We did not open an official page on the electronic visa platform, so its operator, fee and data handling are not confirmed here ⁷.

Contracts and official findings

We found no published contract terms, hosting arrangement or term for the API/PNR system or the automated gates in the records we opened ^3,6. We found no Tribunal de Contas da União or court finding on these systems in those records ⁴.

Chronology