Running a small or mid-sized company in Brazil: the legal essentials

Many legal problems in a small Brazilian company begin with everyday decisions. A contract with no indexation clause. A shareholder who left with no valuation formula in the articles. A contractor treated as a service company without care. A customer database with no lawful basis. A brand someone else registered first. These risks can go unnoticed and generate costs months later.

Preventive versus reactive

There is a structural difference between fixing and preventing. Once the problem exists, the options may be more restricted: the contract is signed, the employee is dismissed, the data has leaked. Before, there is room for preventive steps: a clause drafted, a document signed, an internal process adjusted.

That does not mean every company needs a monthly retainer. It means identifying which decisions are hard to reverse — the standard contracts that will be used hundreds of times, the corporate structure, the annual tax election, the data policy — and treating those with care. Mistakes there repeat at scale.

A note on figures: a lot of material circulates claiming how much preventive advice "saves". We prefer not to repeat averages we cannot source. What can be stated with confidence is what the law provides, and that is what this guide covers.

Contracts: the backbone

Brazilian contract law combines party autonomy, binding force, objective good faith and the social function of contracts. Following Law 13.874/2019, Civil Code article 421 provides for minimal intervention and exceptional contractual revision. Article 421-A presumes civil and commercial contracts to be balanced and symmetrical, subject to concrete evidence to the contrary and special statutory regimes. Writing down the risk allocation matters, but cannot displace mandatory rules.

The recurring drafting failures are familiar. A generic template that does not describe the actual business. A poorly defined scope, a source of service disputes: without a detailed description of the deliverable, a schedule, allocated responsibilities and acceptance criteria, delivery can become disputed. Vague or unrealistic deadlines. No penalty clause, which leaves no agreed contractual sanction but does not remove the obligation or statutory remedies; penalties remain subject to the cap and equitable reduction in Civil Code articles 412 and 413. And no price adjustment mechanism in long-term contracts, which can complicate cost management without creating an automatic right to increase prices.

On the protective side, four clauses earn their keep: force majeure, defining qualifying events, notice procedure and risk allocation; confidentiality, specifying what is protected, for how long and with what consequence; intellectual property, allocating ownership of what is created during performance — critical in technology, marketing and project work; and dispute resolution, choosing deliberately between courts, mediation and arbitration, considering costs, disposable rights and mandatory rules.

Company structure and articles of association

A common vehicle is the sociedade limitada, roughly equivalent to a private limited company, and since Law 13.874/2019 it may be formed by a single quotaholder (Civil Code, article 1.052, paragraphs 1 and 2). That made the older EIRELI vehicle redundant: article 41 of Law 14.195/2021 converted existing EIRELIs into single-member limitadas automatically, with no amendment required.

The articles of association (contrato social) are the company's most important document and the most often neglected. Four points deserve careful drafting, and each only hurts when it is missing:

• Management. Who manages, which acts require joint signature, which need quotaholder approval and above what value. Authority depends on the manager’s powers and applicable law; being a quotaholder does not itself confer management powers.

• Entry and exit of quotaholders. Pre-emption rights, transfer procedure and above all the valuation formula for a departing quotaholder. Silence increases uncertainty and may lead to the statutory valuation rules in article 1.031.

• Succession. What happens to quotas on death: do the heirs join, are they paid out, or do the remaining quotaholders have preference? Article 1.028 generally provides for liquidation of the deceased’s quota, unless the articles provide otherwise, the remaining quotaholders choose dissolution, or they agree with the heirs on substitution.

• Profit distribution and management remuneration. Clear rules keep pay for work distinct from return on capital.

A separate quotaholders' agreement is worth adding: it covers governance, voting, non-compete, investor entry and exit, and can stay outside the public registry, without assuming automatic effects against third parties or dispensing with applicable formalities.

On personal liability: article 49-A recognises separate company assets, but limited liability is not absolute. Quotaholders remain jointly liable for paying in the capital (article 1.052). Personal guarantees, unlawful management acts and special employment, tax and consumer rules can create other exposure. Piercing the corporate veil under article 50 requires abuse through misuse of purpose or commingling of assets; it is not the only route to personal liability. Separate accounts and reliable books help evidence corporate autonomy.

Foreign shareholders and capital

Foreign individuals and entities may own a Brazilian limitada, including wholly, subject to sector restrictions. Incorporating a Brazilian subsidiary differs from opening a branch of the foreign company, which follows its own authorisation procedure. Check CPF or CNPJ registration and a resident attorney-in-fact with service-of-process powers for a non-resident quotaholder.

Foreign documents may require an apostille or consular legalisation depending on the country and treaties, and a sworn translation where applicable. Contract language does not replace those formalities.

Foreign investment follows Law 14.286/2021 and BCB Resolution 278/2022. SCE-IED transaction and periodic reporting have their own thresholds and criteria: not every contribution requires blanket prior registration to enable remittances. Reconcile exchange, corporate and tax documentation with the bank and accountants.

Tax regimes and exposure

Choosing the regime is an annual decision with direct cash-flow impact. Three main routes:

• Simples Nacional (Complementary Law 123/2006): a micro-enterprise with annual gross revenue up to BRL 360,000 and a small business up to BRL 4.8 million (article 3, I and II). It consolidates several taxes into one payment, at rates varying by activity and revenue. Revenue alone does not establish eligibility: proportional limits and exclusions apply, including a corporate quotaholder or a quotaholder domiciled abroad. Nationality alone is not the test.

• Lucro Presumido: available where gross revenue in the prior year did not exceed BRL 78 million (Law 9.718/1998, article 13). The company must not otherwise be required to use Lucro Real; proportional limits may apply. IRPJ and CSLL use statutory presumed margins. In 2026, Complementary Law 224/2025 increases those percentages by 10% on the revenue portion above BRL 5 million annually, subject to period apportionment and each tax’s effective-date rules.

• Lucro Real: mandatory above that threshold and in other statutory cases; IRPJ and CSLL use accounting profit adjusted for tax purposes. Thin margins or losses require modelling; they do not guarantee savings or eliminate all taxes.

No regime is better in the abstract, and the election has to be revisited as the company grows or changes activity.

On exposure, it is worth knowing the size of federal penalties. On an assessment, the fine is 75% of the tax due; where evasion, fraud or collusion is established it rises to 100%, and to 150% on repeat conduct (Law 9.430/1996, article 44, paragraph 1, VI and VII, as amended by Law 14.689/2023, which reduced the qualified rate previously set at 150%). The statutory requirements, aggravations, reductions and constitutional limits require case-specific assessment; no single range covers every penalty.

Hiring and employment liability

A significant area of liability that may not be immediately visible. Key structural points:

• Employment is determined by facts, not labels. Personal performance, regularity, subordination and payment characterise employment even where the contract is with a service company. Engaging a contractor is lawful; disguising an employee as one is not.

• Outsourcing is lawful, including of core activity, under Law 13.429/2017 and Law 13.467/2017, and the Supreme Court confirmed that position in ADPF 324 and RE 958.252 (Theme 725) in 2018. The client company remains secondarily liable for the provider's employment obligations during the contract, which makes checking the provider's compliance a routine rather than a formality.

• Working hours. Overtime carries a minimum premium of 50% over the normal hourly rate (Constitution, article 7, XVI). Weak time records are among the most frequent causes of adverse judgments, because missing records, when legally required, can trigger rebuttable presumptions and affect the burden of proof, subject to exceptions and contrary evidence.

• Dismissal without cause. On top of severance entitlements, a 40% penalty applies on the updated FGTS deposits due during the employment contract, not merely the available account balance (Law 8.036/1990, article 18, paragraph 1). Employees can claim credits from the last 5 years, within 2 years of the contract ending (Constitution, article 7, XXIX) — the five-year lookback generally runs from filing, subject to statutory exceptions.

As checked on 7 September 2026, STF Theme 1.389 (ARE 1.532.603), concerning jurisdiction, burden of proof and civil/commercial engagement of contractors or service companies, had no concluded merits ruling. A national stay has been ordered; check the subject matter, procedural stage and subsequent orders before applying it to a particular claim. This does not make every contractor arrangement automatically valid or invalid.

Consumer relationships

Where a consumer relationship is established, the Consumer Protection Code applies and mandatory rules cannot be contracted out of. Liability for defects is generally strict, but the relevant defect, damage and causal connection still require examination; individual liberal professionals are personally liable on proof of fault (article 14, paragraph 4).

Apparent-defect complaint periods are 30 days for non-durable and 90 days for durable goods and services, from delivery or completion of the service; for hidden defects, time runs when the defect becomes apparent (article 26). These are not universal limitation periods for every consumer claim. The 7-day cooling-off right for off-premises purchases runs from contracting or receipt (article 49), and differs from voluntary preference-based exchanges in physical stores. Misleading or abusive advertising and humiliating collection practices are prohibited (articles 37 and 42). Decree 7.962/2013 requires clear supplier, product and service information in online sales.

LGPD: data protection

Brazil's General Data Protection Law (Law 13.709/2018) applies to business processing of personal data within the scope of articles 3 and 4 — customers, employees, candidates, suppliers. There is no revenue threshold; small companies have a simplified regime for certain obligations but are not outside the statute. Readers familiar with the GDPR will recognise the architecture, though the legal bases and the sanction framework differ.

Adequacy starts with three questions: what data does the company process, on what legal basis, and for how long. Consent is only one of the statutory bases, and many operations sit better on contract performance, legal obligation or legitimate interest, each with its own requirements. Sensitive data have the specific bases in article 11; legitimate interest is not among them. From there come plain-language privacy notices, handling of data subject rights, information security and supplier management.

Two operational duties: controllers appoint a data protection officer under article 41 and ANPD Resolution 18/2024. Eligible small processing agents under Resolution 2/2022 may be exempt, but must maintain a contact channel for data subjects; high-risk processing and other exclusions prevent that simplified treatment. Incidents involving relevant risk or damage generally require notice to the ANPD and affected individuals within 3 working days of learning that personal data were affected (Resolution 15/2024), subject to specific legislation; eligible small agents may receive double time. Have a response plan ready. Article 52 provides warnings, a simple fine of up to 2% of the private legal entity’s, group’s or conglomerate’s Brazilian turnover in the previous financial year, excluding taxes, capped at BRL 50 million per infringement, daily fines, publicity, blocking and deletion of data.

Licensing and regulated activity

Beyond the general rules, each sector has its own regulator: Anvisa for food and health products, Anatel for telecoms, Aneel for energy, plus municipal operating permits, fire-safety certificates and environmental licensing where applicable.

One mechanism is worth knowing. Law 13.874/2019 removed the requirement for public licensing acts — permits and authorisations — for activities classified as low risk. The classification is set by regulation, and the exemption does not remove other obligations. Before opening or relocating, checking the risk classification of the activity and the municipal rule helps avoid operating restrictions; small size does not automatically mean low risk.

Trademarks and intangibles

A brand is often a small company's most valuable and least protected asset. Under Law 9.279/1996, trademark ownership is acquired by a validly issued registration at the INPI, the Brazilian PTO (article 129) — first use does not by itself create an exclusive right, a precedence right requires proven good-faith use in Brazil for at least six months before priority or filing, for identical, similar or related goods or services.

Registration lasts 10 years from grant, renewable for equal and successive periods on application in the final year, or in the next six months with an additional fee (article 133). Applications are published for opposition within 60 days (article 158). A registration can lapse through a requested cancellation proceeding after five years from grant, where use in Brazil never began, was interrupted for more than five years, or changed the distinctive character, subject to legitimate reasons and a defence (article 143). It is not automatic cancellation. Registering a trade name with the commercial registry is not a substitute: they are different rights with different scope.

Integrity and debt recovery

Legal entities generally, not only those with public contracts, must observe the Clean Company Act (Law 12.846/2013), which imposes strict liability on legal entities for acts against public administration. Having an effective integrity programme is a factor in setting sanctions, under the parameters of Decree 11.129/2022. For a smaller company this need not be heavy: a code of conduct, a reporting channel, rules on gifts and hospitality, and basic due diligence on suppliers and partners.

On the other side of the balance sheet, two limitation periods matter. A claim on a liquidated debt evidenced by a public or private instrument prescribes in 5 years (Civil Code, article 206, paragraph 5, I), and a non-contractual civil damages claim generally in 3 years (article 206, paragraph 3, V). Negotiable instruments have their own clocks — enforcement of a cheque, for instance, prescribes 6 months after the presentation period ends (Law 7.357/1985, article 59). Contractual damages and other claims may follow different periods; an out-of-court notice does not automatically interrupt limitation. Postponing a collection routine can mean losing the fastest enforcement route.

Checklist and common mistakes

• Reviewed standard contracts with scope, deadlines, acceptance, adjustment and appropriate penalties.

• Current articles covering management, exit valuation and succession, plus a quotaholders’ agreement where relevant.

• Tax regime reviewed annually and when revenue changes materially.

• Reliable time records where required, and employment or service contracts matching actual work.

• Returns and customer-service policies consistent with consumer law.

• Data map, lawful bases, privacy notice, DPO where required, contact channel and incident plan.

• Current licences and checked activity risk classification.

• INPI trademark application in relevant classes, monitored through grant and maintenance; filing is not registration.

• Collection routine with claim-specific limitation periods.

Common pitfalls include unadapted templates, postponing a quotaholders’ agreement until conflict arises, mixing personal and company assets, delaying trademark protection until growth, and treating data protection solely as an IT project rather than a management responsibility.

Frequently asked questions

Getting the legal side in order is a management decision

A well-structured company is not one that never has problems: it is one that knows where its risks are and has chosen which to accept. Clear contracts, a well-drafted corporate structure, the right tax election, people engaged correctly and data processed on a lawful basis are what allow a business to grow with managed risks. At Falchet e Marques Sociedade de Advogados, a São Paulo firm on Avenida Paulista, we advise small and mid-sized companies on corporate matters, contracts, trademarks and data protection, working in English with founders and investors abroad. The initial review maps what exists and what is missing; fees are quoted in writing after that analysis.

Talk to our team on WhatsApp: +55 11 95901-1854 — and start with the front that weighs most today.

Legal references and editorial update on 7 September 2026: Brazilian Civil Code, articles 49-A, 50, 206 (paragraph 3, V and paragraph 5, I), 421, 421-A and 1.052; Complementary Law 123/2006, article 3; Law 9.718/1998, article 13; Law 9.430/1996, article 44, as amended by Law 14.689/2023; Law 13.874/2019; Law 14.195/2021, article 41; Law 8.078/1990 (Consumer Protection Code), articles 26, 37, 42 and 49; Decree 7.962/2013; Law 13.709/2018 (LGPD), articles 41, 48 and 52; Law 9.279/1996, articles 129, 133, 143 and 158; Law 13.429/2017 and Law 13.467/2017; Supreme Court, ADPF 324 and RE 958.252 (Theme 725); Federal Constitution, article 7, XVI and XXIX; Law 8.036/1990, article 18, paragraph 1; Law 12.846/2013 and Decree 11.129/2022; Law 7.357/1985, article 59. Also: Complementary Law 224/2025; ANPD Resolutions 2/2022, 15/2024 and 18/2024; Law 14.286/2021 and BCB Resolution 278/2022; STF Theme 1.389. Portals: planalto.gov.br, portal.stf.jus.br, gov.br/inpi, gov.br/anpd.