REDATA: What Brazil Gained in Tax Incentives and Lost in Cryptographic Sovereignty

The transition of REDATA—the Special Tax Regime for Datacenter Services—from a Provisional Measure (MP) to a Bill (PL) was not a mere change in legislative instrument. It was a change in essence. MP No. 1,318/2025, signed in September 2025, was born with a dual ambition: to attract digital infrastructure to Brazil and ensure this infrastructure served the country's sovereignty, including the requirement for cryptographic key residency within national territory. Bill No. 278/2026, approved by the Chamber of Deputies in February 2026 and sent to the Senate, preserved the tax incentives but suppressed this technical safeguard. The result is a program that improves the regulatory environment for data center installation in Brazil but ceased to address sovereignty through the only lens that effectively matters: control over who accesses the data, rather than where the hard drives are physically installed.

What is REDATA and what problem was it meant to solve?

REDATA is a special tax regime created to stimulate the installation, expansion, and modernization of data centers—specialized facilities for storing, processing, and managing large volumes of data and digital applications—within Brazilian territory. The program grants a suspension of federal taxes, such as Import Tax, IPI (Industrialized Products Tax), PIS/Pasep, and Cofins, on the acquisition of electronic components and information and communication technology (ICT) assets destined for the data centers' fixed assets.

The backdrop justifying this policy is concrete. Approximately 60% of Brazilians' data is processed outside the country, a situation involving risks to national sovereignty and generating increasing trade balance deficits. In 2024, the electronic sector's deficit was US$ 40 billion, while the telecommunications and computing deficit reached US$ 7.1 billion, with the majority linked to the import of data processing and storage services. Furthermore, operating a data center in Brazil is currently about 30% more expensive than in other regions, primarily due to electricity costs, which discouraged domestic investment for decades.

The government allocated R$ 5.2 billion in the 2026 Annual Budget Law Project to launch the program, with estimates of attracting R$ 2 trillion in private investment over a decade. It is a significant financial commitment and a recognition that digital infrastructure has become a sovereignty imperative rather than just a sectoral issue.

What MP No. 1,318/2025 proposed as a pillar of sovereignty

Provisional Measure No. 1,318 was signed on September 17, 2025, linked to the National Datacenter Policy (PNDC) and the "New Industry Brazil" initiative. Beyond tax incentives and economic and environmental requirements, the MP included the mandate for cryptographic key residency within national territory as a condition for benefiting from the regime.

This requirement was what differentiated REDATA from a simple tax incentive. Cryptographic keys are the mechanism defining who effectively controls access to data stored on a server. When keys remain in the possession of the government or an entity under Brazilian jurisdiction, the foreign data center operator—even if it is a US company like Amazon, Google, or Microsoft—cannot access the data content without authorization. This is the control that matters for digital sovereignty, not the physical location of servers.

By demanding cryptographic key residency in Brazil, the MP built a shield against extraterritorial surveillance laws, such as the CLOUD Act (Clarifying Lawful Overseas Use of Data Act), the 2018 American law obligating US-based companies to hand over data in their custody to US authorities, regardless of where that data is physically stored. Under the MP, the location of the keys shielded the data against this extraterritoriality; without it, server location is insufficient.

What changed in Bill No. 278/2026 approved by the Chamber

MP No. 1,318/2025 expired on February 25, 2026, without a vote because the joint committee responsible for its analysis in Congress was never installed. Deputy José Guimarães (PT-CE), the government leader in the Chamber, introduced Bill No. 278/2026 as a replacement to avoid penalizing investments already made during the MP’s validity due to a normative gap.

The text approved by the Chamber largely reproduces the MP's tax model, suspending the same federal taxes on the acquisition of ICT equipment for data centers. The required trade-offs are twofold: environmental, with 100% of energy demand met by clean or renewable sources and compliance with water efficiency standards; and economic, with the allocation of 2% of investments to R&D projects and the reservation of at least 10% of processing capacity for the national market—a percentage that may be replaced by equivalent R&D contributions.

What the Bill suppressed was precisely the cryptographic key residency requirement. This requirement, which was the technical pillar of data sovereignty, is absent from the text approved by the Chamber and the defined trade-offs. The resulting program improves the regulatory environment for attracting data centers but executes a trade-off: it relinquishes data control in exchange for agility in attracting investment.

The difference between being the country of hard drives and having cryptographic domain

This distinction is central and deserves precise naming. Having a data center located in Brazil means physical servers are in national territory, subject to Brazilian legislation and LGPD (General Data Protection Law) compliance obligations. This has value: it allows direct application of Brazilian laws and regulations to processing agents operating in the country. However, physical location is not equivalent to data sovereignty.

Cryptographic domain, in Consuelo Rodrigues’ analysis, is what defines effective control. A foreign company can install its servers in Brazil, meet all REDATA environmental and economic requirements, and still maintain cryptographic keys in another jurisdiction. In this scenario, if the US government invokes the CLOUD Act to request data stored on those servers, the operator—being an American company—will be legally obligated to comply. The location of the hard drives in Brazil does not alter this obligation.

The practical result is that REDATA, in its current version, creates the conditions for Brazil to become a hub for physical data center infrastructure without necessarily guaranteeing sovereign control over the data flowing within them. We have moved from a policy seeking cryptographic domain to a policy offering tax incentives for physical infrastructure, leaving the question of effective control without a normative answer.

What REDATA still delivers and where sovereignty remains open

It is important to recognize what the program continues to deliver for a balanced assessment. REDATA improves Brazil's context: by zeroing taxes on ICT equipment, it reduces the cost gap that made Brazil less competitive and encourages the installation of digital infrastructure. This move has a concrete effect on sovereignty: data centers in Brazil enable the direct application of Brazilian laws and regulations, including the LGPD, over the data processing operations occurring therein.

The requirements provided in the Bill, such as the 10% capacity reservation for the domestic market and R&D investments, also create a link between tax benefits and the strengthening of the national digital ecosystem. The program is not indifferent to the country’s interests.

However, what REDATA no longer addresses is sovereignty via cryptographic control. This gap is significant. Having hard drives in Brazil without the keys is equivalent to renting a property and handing all copies of the keys to the landlord. The physical structure is ours, but effective access belongs to whoever holds the keys. This is the point left open by the current text, and it is exactly what distinguishes an infrastructure policy from a digital sovereignty policy.

FAQ about REDATA and Digital Sovereignty

Q: What is REDATA?

REDATA (Special Tax Regime for Datacenter Services) is a Brazilian program created to stimulate the installation and expansion of data centers in the country, offering tax benefits such as the suspension of federal taxes (Import Tax, IPI, PIS/Pasep, and Cofins) on the acquisition of ICT equipment. Originally established by MP No. 1,318/2025, it is now moving through the Senate as Bill No. 278/2026.

Q: What was the main change in REDATA from the Provisional Measure to the Bill?

The primary change was the suppression of the cryptographic key residency requirement within national territory. In the original MP version, this requirement served as a pillar of digital sovereignty, shielding data from extraterritorial laws like the CLOUD Act. In the Bill approved by the Chamber, requirements were restricted to environmental goals—such as 100% clean energy use—and economic goals—such as capacity reservation and R&D funding.

Q: Why is cryptographic key residency important for digital sovereignty?

It is important because keys, rather than server location, define who effectively controls data access. If keys are under foreign jurisdiction, operators can be compelled to hand over data to foreign governments under extraterritorial laws like the CLOUD Act, regardless of where the servers are. Without this requirement, physical presence in Brazil does not guarantee sovereignty over the data.

Q: What trade-offs does Bill No. 278/2026 require from beneficiary companies?

It requires three categories of trade-offs. Environmentally, 100% of energy must come from clean/renewable sources and water efficiency standards must be met. Economically, 2% of investment must go to R&D projects in Brazil, and at least 10% of processing capacity must be reserved for the national market (or replaced by equivalent R&D funding).

Q: What is the estimated fiscal impact of REDATA for Brazil?

The estimated fiscal impact is a revenue loss of approximately R$ 5.2 billion in 2026. Conversely, the expectation is to attract up to R$ 2 trillion in private investment in the data center sector over ten years. Brazil's deficit in data processing and storage reached US$ 7.1 billion in 2024; national infrastructure can help reduce this dependency.

Q: Does REDATA strengthen Brazil's digital sovereignty?

It strengthens it only partially. While it encourages physical infrastructure in Brazil—allowing direct application of the LGPD—the suppression of cryptographic key residency means it fails to address effective control. Brazil may become the location for hard drives for foreign infrastructure without ensuring national cryptographic domain, which is the only mechanism that effectively shields data against extraterritorial laws like the CLOUD Act.

Digital sovereignty is not measured in megawatts of clean energy or R&D percentages, though these matter. It is measured by who holds effective control over what flows through the infrastructure. REDATA, in its current version, is a localization policy, not a sovereignty policy. It brings the servers here, and that has value. But as long as there is no national residency requirement for cryptographic keys, data may be in Brazil while control remains elsewhere. This is the distinction that cannot be ignored: governing infrastructure is not the same as governing data. And governing data is, ultimately, governing the rights of the people that data represents.