Brazil · Compliance
PCI DSS compliance in Brazil
Achieve PCI DSS compliance in Brazil with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- New York office team
- Effivity software included
- Academy training included
Who asks for PCI DSS in Brazil
Clients include
PCI DSS compliance in Brazil at a glance
In Brazil, PCI DSS is asked for by buyers and schemes rather than required by law. The drivers below show where the pressure comes from.
Card payments are where Brazilian online commerce, outsourcing and fintech meet rules that no Brazilian statute writes. PCI DSS is maintained by the PCI Security Standards Council, which states that it does not enforce compliance, so payment brands and acquirers decide who must validate and at what level. The Banco Central's Resolução BCB nº 85 sets cybersecurity and cloud contracting duties for payment institutions without naming the standard, and the LGPD adds separate security duties for personal data. Validation is by a Qualified Security Assessor or by a self-assessment questionnaire; no ISO certification body or consultant can validate it. Sterling's New York office helps scope and shrink the cardholder data environment, close gaps and prepare assessor evidence, with Effivity and Sterling Academy included with the engagement.
Who needs PCI DSS in Brazil, and what happens without it
These are the organisations in Brazil that most often need to show PCI DSS.
- Payment institutions, brokers and exchange houses under Banco Central authorityTheir regulator requires a cybersecurity policy and checks on providers, and payment brands add card data rules.
- BPO and contact-centre firms taking card details for overseas clientsClients and acquirers require validation when agents hear, key in or store card data.
- E-commerce, marketplace and ticketing merchantsAcquirers set the validation level by volume and by how card data is handled.
- Fintech and software providers that store, process or transmit card dataService providers are validated at a level their customers and brands require.
- Telecom, travel and retail groups with card featuresCard acceptance or issuing features bring the systems involved into scope.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the PCI DSS readiness checkPCI DSS requirements in Brazil
Strip away the vocabulary and PCI DSS asks any business that stores, processes or transmits card data to comply in six areas.
In Brazil these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: PCI DSS explained →
How to achieve PCI DSS compliance in Brazil
One team from the New York office carries the work from scoping to sign-off. Clients across Brazil are served from Sterling's New York office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against PCI DSS and the Brazilian requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does PCI DSS compliance take in Brazil?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Brazil these are the factors that set the timeline.
- Size of the cardholder data environment and its segmentation
- Number of payment channels, systems and service providers
- Maturity of logging, vulnerability management and access control
- Acquirer and assessor scheduling
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does PCI DSS compliance cost in Brazil?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Brazil these factors move both.
- Scale of the in-scope environment and merchant or service provider level
- Segmentation, tokenisation or tooling changes
- Assessor fees, quoted separately from readiness consulting
- Scanning and penetration testing
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
PCI DSS consultants and assessors in Brazil
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers PCI DSS and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Brazil are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive PCI DSS in Brazil (3)
| Instrument | How it treats the standard |
|---|---|
| PCI Security Standards Council — role and programmes | Scheme rule The Council develops and maintains the standard, says it does not enforce compliance, and leaves the requirement to comply or validate to organisations that manage compliance programmes such as payment brands and acquirers. |
| Resolução CMN nº 4.893 of 26 February 2021 and Resolução BCB nº 85 of 8 April 2021 | Related The BCB text for payment institutions requires a cybersecurity policy, incident handling and due diligence on service providers; it does not name PCI DSS. |
| Lei Geral de Proteção de Dados Pessoais (Law No. 13,709 of 14 August 2018) | Related Separately requires security measures for all personal data; PCI DSS covers payment account data and does not replace it. |
Accreditation, audit language and remote audits in Brazil
PCI DSS is a compliance obligation set through the payment brands and acquirers, not an ISO-style certificate from an accreditation scheme. Depending on role and volume, validation is by a Qualified Security Assessor producing a Report on Compliance or by a self-assessment questionnaire, as your acquirer requires. Neither Sterling nor an ISO certification body validates it, and the PCI Security Standards Council says it does not enforce compliance. Ask your acquirer or card brand which level and evidence apply to you. Edition and transition details: PCI DSS hub →
Audit language
Portuguese is the usual language of regulators, contracts and audit records, while English is common inside multinationals; agree the audit language, any interpreter and the language of controlled documents with the certification body at application.
Remote and on-site
Assessors review systems, networks and records; evidence collection and walkthroughs are often remote, while data centres, payment operations rooms and contact centres in scope may be visited.
PCI DSS in Brazil: questions clients ask
Does the Banco Central make PCI DSS compulsory in Brazil?
Resolução BCB nº 85, which covers payment institutions, requires a cybersecurity policy, incident handling and care in contracting data and cloud services, but it does not name PCI DSS. Card rules come from the payment brands and acquirers who set who must validate and how. Ask your acquirer for the level that applies to you.
Is PCI DSS a certificate?
Not in the ISO sense. Validation is by a Qualified Security Assessor issuing a Report on Compliance, or by a self-assessment questionnaire, according to your level and what the acquirer or brand requires. The Council states it does not enforce compliance. Confirm with your acquirer which document it wants to see each year.
Do Brazilian BPOs that take card payments need PCI DSS?
Usually, through the client or its acquirer, whenever agents hear, key in or store card details. Client contracts spell out the level of validation. Tokenised payment tools, call-recording controls and clean-desk rules reduce scope and shrink the assessment. Read the contract and security schedule first, and confirm the level with the client.
How does PCI DSS relate to the LGPD?
They overlap on security but differ in scope. PCI DSS protects payment account data in the environment that handles it, while the LGPD covers all personal data and adds legal bases, rights, an encarregado and incident reporting to the ANPD. A PCI validation evidences some safeguards but does not satisfy the Law. Take advice on the rest.
More on PCI DSS for Brazilian organisations
- PCI DSS: the complete guide
- Watch: How to implement PCI DSS
- Banking and financial services: PCI DSS for the sector
- BPO and contact centres: PCI DSS for the sector
- E-commerce and retail: PCI DSS for the sector
- Fintech and payment facilitators: PCI DSS for the sector
- Healthcare providers and insurers: PCI DSS for the sector
- Hospitality and travel: PCI DSS for the sector
- Software and hosting: PCI DSS for the sector
- PCI DSS compliance in Brazil and every other standard Sterling delivers there
Other standards Brazilian businesses ask Sterling for
Organisations in Brazil often combine PCI DSS with one of these, under one management system where the scopes allow.
Start with a free discovery call from the New York office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- PCI Security Standards Council — role and programmes — pcisecuritystandards.org (accessed 11 Oct 2026)
- Resolução CMN nº 4.893 of 26 February 2021 and Resolução BCB nº 85 of 8 April 2021 — bcb.gov.br (accessed 11 Oct 2026)
- Lei Geral de Proteção de Dados Pessoais (Law No. 13,709 of 14 August 2018) — planalto.gov.br; gov.br (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the New York team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
usa@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice