SaaS Agreement in Brazil: Template, Key Clauses and Local Law (2026)

A SaaS agreement in Brazil is a contract to use software hosted by a provider and reached over the internet for a recurring fee. Brazil has no SaaS-specific statute. A SaaS contract runs on freedom of contract and the Civil Code, with the internet law, the data protection law and the tax treatment of software all shaping how it is drafted. This guide explains the Brazilian legal framework, the clauses a SaaS agreement should carry, and a template skeleton. It is general information, not legal advice. ## What law governs a SaaS agreement in Brazil? There is no single SaaS law. The framework is: - The Civil Code (Law No. 10,406/2002) for formation, interpretation, performance and liability, with freedom of contract as the default in business dealings.

• The Marco Civil da Internet (Law No. 12,965/2014), Brazil's framework for internet use, which sets principles on privacy, data protection, net neutrality and provider responsibilities for online activity.
• The Lei Geral de Protecao de Dados (LGPD, Law No. 13,709/2018), Brazil's general data protection law. Where the provider processes personal data for the customer, it typically acts as an operador (processor) and the controller and processor should set out their roles, security measures and breach handling in the contract. The Autoridade Nacional de Protecao de Dados (ANPD) is the supervisory authority.
• Consumer law (the Consumer Defence Code) if the customer is a consumer rather than a business. A Brazil-specific drafting point is tax. The Supreme Federal Court (STF), in ADI 1,945 and ADI 5,659, settled that licensing the use of software is treated as a service subject to municipal service tax (ISS), with the change in treatment taking effect from the May 2021 ruling date. ISS rates are set by each municipality. This affects how SaaS fees are characterised and invoiced. ## Is a SaaS agreement enforceable in Brazil? Yes, as an ordinary commercial contract. Two practical points: - Commercial terms are mostly free to agree in business deals, subject to the Civil Code's good-faith and social-function principles; consumer deals carry extra mandatory protections.
• Data protection is not waivable. The parties cannot contract out of LGPD duties. Processing roles, security and breach notification obligations are compliance requirements, not just drafting choices. ## Key clauses in a Brazilian SaaS agreement ### Service description and scope Define the software, the subscription tier, user limits and what is in and out of scope. ### Service levels (SLA) State uptime targets, support response times, maintenance windows and the remedy for a miss (usually service credits). ### Fees, billing, taxes and price changes Set the fee, billing cycle, how ISS and any other taxes are handled, what triggers an increase and the notice required. Make auto-renewal explicit. ### Data protection (LGPD) Identify the controller and processor (operador), the purpose and duration of processing, security measures, subprocessor rules, data subject rights support, breach notification, and data return or deletion at the end. Address international transfers under the LGPD rules. ### Security and breach notification Describe security controls, encryption in transit and at rest, and the time within which the provider notifies the customer of a security incident so the customer can meet its own LGPD and ANPD obligations. ### Intellectual property and licence Confirm the provider keeps ownership of the software and grants a non-exclusive, non-transferable right to use it during the term; the customer keeps ownership of its data. ### Confidentiality Protect each side's confidential information with standard carve-outs. ### Liability and indemnities Cap liability and carve out items that should not be capped, keeping the allocation consistent with the Civil Code and, for consumer deals, consumer law. ### Term, termination and exit / data return Set the term, renewal and termination rights, and a structured exit: the customer exports its data in a usable, structured format within a stated window and the provider deletes it afterwards, consistent with LGPD. ### Governing law and disputes Choose Brazilian law and a forum. ## Template skeleton ```

1. Parties and definitions
2. The service and scope
3. Service levels and support
4. Fees, taxes (ISS) and price changes
5. Customer data and intellectual property
6. Data protection (LGPD) and international transfers
7. Security and incident notification
8. Confidentiality
9. Warranties and disclaimers
10. Liability and indemnities
11. Term, renewal and termination
12. Exit and data return / deletion
13. Governing law (Brazil) and dispute resolution
14. Signatures

- **Tax characterisation matters.** Since ADI 1,945 and ADI 5,659, licensing the use of software is treated as a service subject to municipal ISS; address how ISS is handled in the fee clause.
- **Marco Civil sets internet-use principles.** Privacy, data protection and provider responsibilities under Law No. 12,965/2014 form the backdrop to any online service.
- **Consumer deals are different.** If you sell to consumers, the Consumer Defence Code adds mandatory protections a business template does not cover. ## From the contract to the subscription you actually run Signing the SaaS agreement is one moment; managing it is the rest of the year. Someone must track the renewal date so a price rise does not slip through, hold the provider to the SLA, keep the LGPD processing terms current as subprocessors change, and find the exit clause fast when a service is cut. Across a stack of SaaS contracts, that work is easy to lose. An AI contract workspace keeps each SaaS agreement, its clause structure, renewal and notice dates and data protection schedule in one place, so you can draft from a template, see where terms are one-sided, edit in plain language, and get a reminder before a deadline. If you want to see drafting, review, tracking and governance in a single workspace, [Adira](https://adiralaw.com) is built around that idea. Deep Brazil-specific jurisdiction coverage is on Adira's roadmap today; India is deepest now. ## FAQ