Hotel IT and data compliance in Brazil: a guide for international hotel groups

Brazil is one of the largest hotel markets in Latin America, and international brands keep arriving through new builds, conversions, management contracts and acquisitions. Most of what a group already does for IT and data protection in Europe or the United States carries over. The problems come from the parts that do not: a data protection law that looks like the GDPR but has different deadlines, a payment system most foreign teams have never used, tax rules that reach into the PMS and POS, and suppliers who work in Portuguese.

This guide covers the points we see international groups miss most often. It is general information, not legal advice: for decisions with legal consequences, confirm the details with a Brazilian lawyer.

Key points at a glance

• Data protection: the LGPD (Law 13.709/2018) applies to any hotel processing guest data in Brazil. It is close to the GDPR, but a GDPR programme needs local adjustments.
• Breach reporting: 3 business days to notify the ANPD and affected guests, not 72 hours.
• Transfers abroad: sending guest data to a group CRM or loyalty platform outside Brazil needs a Brazilian transfer mechanism, usually the ANPD standard contractual clauses.
• Payments: Pix, the Central Bank's instant payment system, is a major payment method in Brazil and a common channel for booking fraud. PCI DSS still applies to cards.
• Tax: hotel systems must issue Brazilian electronic tax documents, which often means local integrations for international PMS and POS platforms.
• Hardware and suppliers: telecom equipment needs ANATEL certification, imported hardware takes longer and costs more, and supplier contracts are normally in Portuguese.

LGPD: Brazil's data protection law

The Lei Geral de Proteção de Dados (LGPD) came into force in September 2020, and its administrative sanctions have applied since August 2021. It is enforced by the Autoridade Nacional de Proteção de Dados (ANPD). Like the GDPR, it applies based on where data is processed and where the data subjects are, so a hotel in Brazil falls under it regardless of where the brand is headquartered.

A hotel handles more personal data than most businesses: identity documents, contact details, payment data, stay history and preferences, CCTV images, Wi-Fi logs and, increasingly, biometrics for facial recognition or access control. Biometric data is sensitive personal data under the LGPD, with stricter rules on legal basis and security.

LGPD compared with the GDPR

What this means in practice for a hotel

• Map legal bases in Brazilian terms. The group's GDPR records of processing are a good starting point, but each purpose should be checked against the LGPD's ten bases, particularly marketing, loyalty and CCTV.
• Appoint and publish the encarregado. Resolution CD/ANPD 18/2024 regulates the role. Their identity and contact details must be public, usually on the hotel's website, and guests must be able to reach them in Portuguese.
• Rewrite the incident plan for 3 business days. A group process built around 72 hours and a central privacy team in another time zone can easily miss the Brazilian deadline. Decide locally who assesses an incident and who reports it.
• Put transfer clauses in place. Resolution CD/ANPD 19/2024 approved standard contractual clauses for transfers out of Brazil, and existing contracts had until August 2025 to incorporate them. Group CRM, loyalty, central reservations, email marketing and cloud back-office systems are the usual transfers to check.
• Localise the privacy notice and data subject channel. A translated group policy is not enough if it refers to rights and bodies that do not exist in Brazil.

For more detail, see our Portuguese guides on the LGPD for hotels and on what to do in the first 48 hours after a data breach.

Payments: Pix, fraud and PCI DSS

Pix is the instant payment system launched by the Banco Central do Brasil in November 2020. Payments settle in seconds, around the clock, using a key such as a phone number, email or tax ID, or a QR code. Guests and companies use it widely for deposits and full payments, so hotels need to accept it.

Because Pix is instant, it is also a favourite channel for fraud. The patterns hotels see most are fake payment receipts sent to the front desk or reservations team, guests tricked into paying a fraudster's Pix key through a compromised OTA account or a fake WhatsApp profile, and calls impersonating managers or suppliers asking for urgent transfers. The Central Bank's special return mechanism (MED) lets victims ask their bank to recover funds in fraud cases, but recovery is not guaranteed.

The controls that work are mostly process: confirm every payment in the bank account or payment platform, never on a receipt; publish the hotel's official channels and Pix key; and never change payment details because of a phone call or message. Our Portuguese guide on Pix and booking fraud covers the scenarios in detail.

Card payments still fall under PCI DSS. Version 4.0.1 is the current standard, and its future-dated requirements became mandatory on 31 March 2025. In Brazil the scope question usually sits with local acquirers and payment terminals, so confirm how card data flows between the terminals, the POS and the PMS before assuming the group's PCI scope covers the Brazilian property.

Guest registration and Wi-Fi logs

Hotels in Brazil must register guests using the Ficha Nacional de Registro de Hóspedes (FNRH), the national guest registration form, under the General Tourism Law (Law 11.771/2008) and Ministry of Tourism rules. The form collects identity data for every guest, so it belongs in the hotel's data map, with clear retention and access rules.

Guest Wi-Fi raises a second question. The Marco Civil da Internet (Law 12.965/2014) sets log retention duties for internet connection and application providers. Whether and how they apply to a hotel's guest network depends on how the service is provided and by whom, so agree the logging and retention model with your Wi-Fi provider and confirm it with legal counsel.

Electronic invoicing and hotel systems

Brazilian businesses issue electronic tax documents for their sales, and hotels are no exception: accommodation, food and beverage and other services all generate them. International PMS and POS platforms often need a certified local integration, sometimes from a third party, to issue these documents correctly.

Brazil is also in the middle of a consumption tax reform. The transition to the new taxes (CBS and IBS) began in 2026 and runs for several years, and it changes invoice formats along the way. Before standardising on a group PMS or POS in Brazil, ask the vendor who maintains the fiscal integration, how it is supported locally and how they will handle the reform. Our hotel systems service covers this assessment.

Hardware, infrastructure and local suppliers

• ANATEL certification. Telecom and radio equipment, including Wi-Fi access points, needs certification from ANATEL, the national telecom regulator. Equipment from a global standard catalogue may not have it.
• Import costs and lead times. Imported hardware carries significant import taxes and longer delivery times. For openings, order early or choose models that are already sold in Brazil.
• Power. Mains voltage is 127 V or 220 V depending on the region, and Brazil has its own plug standard. Specify power supplies, UPS units and redundancy with this in mind.
• Contracts in Portuguese. Local suppliers normally contract in Portuguese under Brazilian law. Review SLAs, support hours and data processing clauses in the Portuguese version, since that is usually the one that counts.
• Support coverage. Check what each supplier covers outside business hours and on public holidays, which vary by state and city.

For new properties, the cheapest time to get this right is at design stage, 12 to 18 months before opening. See our new builds and renovations service.

Artificial intelligence

Brazil does not yet have a dedicated AI law in force. The main bill, PL 2338/2023, was approved by the Senate in December 2024 and, at the time of writing, is still going through Congress, so check its status before relying on it. In the meantime, the LGPD already applies to AI tools that process guest or employee data, including chatbots, revenue tools and anything that makes automated decisions about people. See our AI governance service.

Checklist before opening or acquiring a hotel in Brazil

• LGPD data map, legal bases and privacy notice in Portuguese
• Encarregado appointed and published, with a Portuguese-language channel
• Incident response plan that meets the 3-business-day deadline
• ANPD standard contractual clauses for every transfer abroad
• Pix payment verification process and staff training on fraud
• Card data flows and PCI DSS scope confirmed for local terminals
• PMS and POS fiscal integration and tax reform roadmap confirmed
• Guest Wi-Fi logging and retention model agreed with the provider
• Hardware checked for ANATEL certification, voltage and lead times
• Supplier contracts, SLAs and out-of-hours coverage reviewed in Portuguese

How HotelTI can help

HotelTI is a Brazilian hotel technology consultancy. We work with hotels and resorts on IT management, cybersecurity and LGPD compliance, and we act as the local technology lead for groups that do not have one in Brazil: translating group standards into what works locally, selecting and managing Brazilian suppliers and reporting back to headquarters in English. We do not resell software or hold agreements with specific suppliers.