GRC platform in Brazil: how to choose the right one

Choosing a GRC platform in Brazil starts with the criteria of any evaluation, such as the data model, the control crosswalk and the audit trail. But it ends with questions that only make sense here: which regulators your organisation answers to, how the tool supports the LGPD day to day and where the GRC data itself is kept. This guide covers that second part.

If you are still deciding between a spreadsheet, point tools and an integrated platform, start with the guide GRC Software: What It Is and How to Choose, which covers the scorecard, the proof of value and the warning signs. For the enterprise risk view and what the board needs to see, read the guide to enterprise risk management software in Brazil. Here, the focus is on what to add to that evaluation when the platform will operate under Brazilian regulation.

Start with your organisation’s regulatory map

Before the first demo, list the rules your organisation answers to. The LGPD reaches almost every company that processes personal data. Sector rules depend on who supervises your business. The table summarises the most common ones in cybersecurity and integrity. It does not cover every rule in each sector and does not replace a legal review.

Who	Rule	What the platform must support
Anyone processing personal data	LGPD (Law No. 13,709/2018) and ANPD Resolution No. 15/2024	Record of processing operations, security measures, incident notification within three business days and an incident record kept for at least five years
Institutions authorised by the Central Bank of Brazil	CMN Resolution No. 4,893/2021, as amended by CMN Resolution No. 5,274/2025	Cybersecurity policy and incident action and response plan approved by the board, annual review, annual report and cloud contracting rules
Payment institutions, brokers and distributors	BCB Resolution No. 85/2021, as amended by BCB Resolution No. 538/2025	The same topics, in the rule specific to these segments
Insurers, open pension entities, capitalisation companies and local reinsurers	SUSEP Circular No. 638/2021	Cybersecurity policy, incident handling and requirements for outsourcing data processing and storage
Electricity sector agents	ANEEL Normative Resolution No. 964/2021	A policy with minimum content, annual application of at least one maturity model, recording and analysis of higher-impact incidents and controls required of service providers
Telecommunications providers	Anatel Resolution No. 740/2020 (Cybersecurity Regulation for the Telecommunications Sector)	Cybersecurity policy and incident management in line with the sector regulation
Companies in general (integrity)	Law No. 12,846/2013 and Decree No. 11,129/2022	Assessment criteria for the integrity programme, where the company has one: risk management with periodic reassessment, internal controls, whistleblowing channels and due diligence on third parties

Two requirements for the platform follow from this. The first is accepting your own requirements. Ready-made libraries tend to prioritise international standards such as ISO/IEC 27001 and NIST CSF, and a Brazilian rule from your sector may have to be entered by you. Ask to see, in the demo, that rule set up as a framework and mapped to controls that already exist. The second is versioning the mappings. Brazilian rules change: Resolution 4,893, for example, was amended at the end of 2025 (see what changed with CMN Resolution 5,274). The platform needs to show which version of the requirement each control meets and what changes when the rule is revised.

The LGPD as an operating routine, not a project

The LGPD does not require any specific software. But it asks for things a GRC platform can either support or complicate: a record of processing operations (Article 37), technical and administrative security measures (Article 46) and, if the controller chooses to adopt one, a privacy governance programme that, under Article 50, includes incident response plans and is updated on the basis of continuous monitoring and periodic assessments (Law No. 13,709/2018).

Incidents come with a short deadline. ANPD Resolution No. 15/2024 requires the controller to notify the ANPD (Agência Nacional de Proteção de Dados, Brazil’s national data protection authority) and the data subjects, within three business days, of any incident that may cause relevant risk or harm, counted from the moment it learned that personal data was affected. The same rule requires the incident record to be kept for at least five years (ANPD Resolution No. 15/2024). In the platform, that becomes concrete questions:

Clock. Does the incident record when the organisation became aware of it and who is responsible for the notification?
History. Is the incident record, including incidents that were not notified, kept with authorship and dates for the required period?
Context. Is the inventory of processing operations linked to the assets, suppliers and controls that protect it?
The DPO’s view. Can the data protection officer (the “encarregado”, Article 41) follow the status without asking each area for spreadsheets?

The financial weight is real too. A simple fine can reach 2% of the revenue of the legal entity, group or conglomerate in Brazil in its last financial year, excluding taxes, capped at R$ 50 million (Brazilian reais) per infringement (Article 52). To organise the controls before taking them into the platform, use the practical LGPD compliance checklist.

Professionals analysing a data dashboard on a large computer screen

Integrity and anti-corruption are GRC too

In many Brazilian companies, anti-corruption compliance sits outside the GRC tool, under a different department. Decree No. 11,129/2022, which regulates Law No. 12,846/2013 (Brazil’s Anti-Corruption Law), lists in Article 57 the criteria for assessing an integrity programme. They include adequate risk management with periodic reassessment, internal controls, whistleblowing channels and risk-based due diligence when hiring and supervising third parties (Decree No. 11,129/2022).

Much of this fits the same data model as GRC: risks, controls, third parties, evidence and action plans. If the platform cannot hold this domain, the same supplier ends up assessed twice, once by information security and once by integrity, with different questionnaires and deadlines. In financial services, third-party assessment also has to meet the rules on contracting services, the subject of the guide to third-party risk and CMN Resolution 4,893.

Where the GRC data itself is kept

A GRC platform concentrates sensitive information: risks, vulnerabilities, incidents, critical suppliers and, often, personal data about employees and data subjects. That is why the GRC vendor is also a third party to assess.

International transfers. If personal data is processed outside Brazil, the LGPD only allows the transfer in the cases listed in Article 33, such as countries with an adequate level of protection or standard contractual clauses. ANPD Resolution No. 19/2024 approved the regulation and the text of the standard clauses. Ask where the data is hosted, which sub-processors are involved and which mechanism covers the transfer.
Financial services. CMN Resolution No. 4,893/2021 has its own chapter on contracting data processing, data storage and cloud computing services. Check with legal and risk, before signing, whether the GRC platform falls under those rules in your case.
Getting the data out. Confirm that everything can be exported in an open format. Changing vendor must not mean losing the history that a regulator will ask for.

Hands typing on a laptop with digital security and padlock icons

Language, evidence and support

Brazilian auditors, data protection officers and regulators work in Portuguese. Reports, audit trails and approval workflows in that language reduce translation and noise. Also check whether the platform accepts the evidence formats used in your operation, whether support covers your time zone and whether the contract, SLA and security documentation are available in Portuguese.

A Brazilian test for the demo

Add these steps to the proof of value described in the GRC software guide. They quickly show whether the platform was built with the local regulatory context in mind or whether that will be left to you.

Set up a rule from your sector, such as CMN Resolution No. 4,893/2021 or ANEEL Normative Resolution No. 964/2021, as a framework and map three existing controls to it.
Simulate an incident involving personal data and see how the tool records the date of awareness, the owner and the three-business-day deadline.
Assess a critical supplier once and see whether the result serves security, privacy and integrity.
Change a control and check the effect on every mapped requirement, including the Brazilian ones.
Ask for written answers on hosting, sub-processors and international data transfers.

Record the result in the scorecard as one more criterion: fit with the Brazilian regulatory context.

AI with a trail, including for the regulator

In the 2025 edition of IBM’s Cost of a Data Breach report, Brazilian organisations that used AI and automation extensively in security had an average cost of R$ 6.48 million per breach, against R$ 8.78 million for those that did not. The same edition found that 87% of Brazilian organisations had no AI governance policies in place (IBM Newsroom Brazil, July 2025, covering breaches between March 2024 and February 2025). The data concerns security, not GRC, but it shows both sides of the issue: AI helps, and governance over it is still weak.

In a GRC platform, AI can suggest classifications, mappings between standards and priorities. The decision to accept a risk, approve a piece of evidence or notify an incident still belongs to a person, and the platform needs to record who reviewed each suggestion. That record is what lets you explain the decision to an auditor or to the ANPD. The guide to AI compliance tools in Brazil covers this point in detail, and the guide to AI governance software deals with the risk of the models themselves.

Eagle and this playbook

The GRC module of Eagle, from Futture, was designed to centralise frameworks, requirements, policies, controls, evidence, assessments and action plans in a reusable model, with a crosswalk between standards and the ability to build custom requirements and controls, which is the way to set up Brazilian sector rules. Eagle’s AI suggests classifications, relationships and priorities, and the user reviews, approves, rejects or adjusts each relevant result. The integrations available depend on the environment and the contracted scope. If you would like to run the Brazilian test above with a case of your own, request a demo.

Further reading: AI compliance software for banks; Risk Matrix: How to Build It and Prioritise Threats; AI Security Software to Reduce Cyber Exposure; CMN Resolution 4,658: what changed and what applies now; ANPD regulations: a map of what your company must comply with; SUSEP Circular 638: cybersecurity rules for Brazilian insurers.

Frequently asked questions

What is a GRC platform?

It is the system that connects governance, risk and compliance in a single base: requirements from standards and laws, controls, evidence, risks, third parties and action plans, with a history of who decided what. It supports the organisation’s GRC model, but does not replace it.

Which Brazilian rules does a GRC platform need to cover?

It depends on the sector. The LGPD, Brazil’s General Data Protection Law, applies to almost every organisation that processes personal data. Financial institutions answer to CMN Resolution No. 4,893/2021 or BCB Resolution No. 85/2021; insurers to SUSEP Circular No. 638/2021; the electricity sector to ANEEL Normative Resolution No. 964/2021; and telecommunications providers to Anatel Resolution No. 740/2020. More important than a ready-made list is that the platform accepts custom requirements and versions its mappings.

Does the LGPD require a company to have a GRC platform?

No. The law does not require any specific software. Among other things, it requires a record of processing operations, security measures and the notification of relevant incidents, which ANPD Resolution No. 15/2024 set at three business days. A platform helps meet these points with owners, deadlines and history, but compliance depends on how the process is run.

Can I use a GRC platform hosted outside Brazil?

Yes, provided the international transfer of personal data fits one of the cases in Article 33 of the LGPD, such as the standard contractual clauses approved by the ANPD. In financial services, also assess the cloud contracting rules in CMN Resolution No. 4,893/2021. Ask the vendor, in writing, for the data location, the sub-processors and the mechanism that covers the transfer.

Can AI make risk and compliance decisions?

It should not. AI can suggest classifications, mappings and priorities, but accepting a risk, approving a piece of evidence or deciding to notify the ANPD of an incident are decisions for people with formal accountability. The platform needs to record who reviewed and approved each suggestion.