Open Company Data in Brazil: Official Sources, APIs and Reuse Rights

Brazil is one of the strongest open-company-data markets in Latin America because it combines official CNPJ public data from Receita Federal, federal open-data catalogue evidence, procurement API and open-data layers, CVM open datasets, INPI open-data context and GLEIF legal-entity identifiers. That strength does not make every business-data use automatically lawful or complete. The correct approach is to separate the official company/tax identifier backbone from procurement participation, listed-company regulation, IP ownership, LEI coverage and any private contact-data process.

This refresh is written for analysts, data buyers, KYB teams and market-research users who need a practical source map rather than a thin list of portals. It explains which Brazil sources are official, which ones are suitable for bulk/API discussion, which ones are enrichment-only, and which claims remain blocked under LGPD, source terms and marketing-contact rules.

The live CompaniesData Brazil article was already public at https://companiesdata.cloud/open-company-data-brazil.html, but the current editorial standard now requires a deeper reference article. The source recheck on 2026-06-09 found 10 publication-safe official/high-quality sources, 3 held routes and no hard 404/410 failures. Held routes in this node are: IBGE CEMPRE statistics, Diario Oficial da Uniao search, Transparency Portal sanctions.

Key Takeaways

• Best core source: Receita Federal CNPJ public data is the primary official backbone for Brazil company and establishment identity.
• Best bulk evidence: the CNPJ dataset and metadata support a confident bulk-data discussion, with file-size, field-layout and update-risk caveats.
• Best API/open-data support: PNCP, Compras.gov.br, CVM datasets, INPI open data and GLEIF help build enrichment layers around the CNPJ core.
• Best caution: CNPJ partner and establishment fields can be privacy-sensitive or contact-adjacent under LGPD and must not be treated as outreach consent.
• CompaniesData value: Brazil is strong at the source level, but production users still need normalization, deduplication, provenance, update tracking, privacy flags and contact-data separation.

Editorial Methodology

The CompaniesData country method starts with official sources, then classifies each source by authority, access model, reuse note, business use and limitation. Registry, tax, open-data, procurement, regulator, IP, statistics, gazette, sanctions and LEI sources are not merged into one bucket because each layer proves a different claim.

For this Brazil refresh, only sources that returned stable content or API data in the recheck are linked as clean evidence. Official routes that timed out, returned human-verification responses or rejected simple automated requests are documented as held-source risks. That policy avoids turning an HTTP 200 challenge or an access-controlled page into a false source-quality signal.

Source logos and favicons are used as decorative recognition cues in the source matrix and Resource Pack. They do not replace the evidence: the official URL, public owner, access model, reuse note and source limitation remain the proof.

Coverage, Access and Update-Risk Analysis

CNPJ backbone: CNPJ is the practical core identifier for legal entities and establishments in Brazil. It supports matching, deduplication, entity resolution and update monitoring, but it must be interpreted with the field definitions and privacy constraints documented by Receita Federal.

Establishment and partner boundary: Brazil’s CNPJ public data can include establishment-level and partner-related fields. These fields are useful for lawful business verification and enrichment, but they do not create permission to build email, phone or sales-prospecting lists.

Bulk-file risk: CNPJ bulk data is powerful but operationally heavy. A production pipeline needs file inventory, checksum handling where available, parser versioning, load dates, deduplication rules, change detection and recovery logic when resource names or publication cadence changes.

Open-data catalogue risk: dados.gov.br is a discovery layer. Catalogue metadata, resource links, licences and source owners should be checked at dataset level before ingestion. Do not generalize one dataset’s reuse terms to every Brazil government dataset.

Procurement scope: PNCP and Compras.gov.br identify contracting events, suppliers and public purchasing context. They are strong enrichment layers, but they are not complete legal-company registers.

Regulator scope: CVM open datasets cover listed/open and regulated-market companies. CVM data is high quality for that subset, not a universal source for every Brazilian business.

IP and LEI scope: INPI and GLEIF improve entity matching and cross-border verification. Trademark, patent and LEI records should be joined as enrichment with coverage flags because many companies do not have IP filings or LEIs.

Reuse Checklist

• Authority check: store whether a field came from Receita Federal, dados.gov.br, PNCP, Compras.gov.br, CVM, INPI or GLEIF.
• Licence check: preserve the dataset terms, publication notes and no-endorsement wording for each official source.
• Attribution check: keep source URLs, owner names and access dates available for audits and customer documentation.
• Field check: separate legal name, trade name, CNPJ root, establishment id, CNAE, status, address, partner-related fields and enrichment fields.
• Privacy check: flag natural-person-adjacent, partner, representative, address and contact-like data before reuse.
• Marketing check: treat company identity and contact-data enrichment as separate products with separate lawful basis review.
• Coverage check: mark whether a record is a CNPJ entity, establishment, supplier, listed company, IP owner or LEI holder.
• Update check: capture source publication date, local ingestion date, parser version and transform version.
• Claims check: avoid saying Brazil has every corporate act, beneficial ownership record or current status in one free file.

Resource Pack

Source-by-Source Deep Dives

1. Receita Federal CNPJ guidance

Authority: identifier / tax authority. Type: official tax identifier / CNPJ guidance. Access model: documentation / search / downloads. Reuse note: official public-data terms and privacy limits.

Primary official CNPJ context for legal entities and establishments. For CompaniesData ingestion, preserve the original URL, access date, source owner, field-level provenance and update cadence before joining it to any commercial profile.

Limitation: Guidance route, not a legal opinion on all reuse scenarios. Treat this as one evidence layer, not proof of complete coverage, official endorsement, unrestricted redistribution, beneficial-ownership completeness or contact-data permission.

2. Receita Federal CNPJ open dataset

Authority: identifier / tax authority. Type: official CNPJ public-data dataset. Access model: dataset page / bulk files. Reuse note: dataset-specific public-data terms with LGPD caution.

Core national company, establishment, partner, CNAE and status data context. For CompaniesData ingestion, preserve the original URL, access date, source owner, field-level provenance and update cadence before joining it to any commercial profile.

Limitation: Large files; partner and natural-person-adjacent fields require LGPD/purpose review. Treat this as one evidence layer, not proof of complete coverage, official endorsement, unrestricted redistribution, beneficial-ownership completeness or contact-data permission.

3. CNPJ metadata PDF

Authority: identifier / tax authority. Type: official CNPJ data dictionary. Access model: PDF / metadata. Reuse note: official documentation.

Field layout and data-dictionary evidence for CNPJ files. For CompaniesData ingestion, preserve the original URL, access date, source owner, field-level provenance and update cadence before joining it to any commercial profile.

Limitation: Metadata only; not the dataset itself. Treat this as one evidence layer, not proof of complete coverage, official endorsement, unrestricted redistribution, beneficial-ownership completeness or contact-data permission.

4. Brazil open-data portal

Authority: official open data. Type: official open-data portal. Access model: catalogue / CKAN-style discovery. Reuse note: dataset-specific Brazilian open-data terms.

Discovery route for federal datasets and source-owner pages. For CompaniesData ingestion, preserve the original URL, access date, source owner, field-level provenance and update cadence before joining it to any commercial profile.

Limitation: Catalogue quality and freshness vary by dataset. Treat this as one evidence layer, not proof of complete coverage, official endorsement, unrestricted redistribution, beneficial-ownership completeness or contact-data permission.

5. Compras.gov.br open data

Authority: official procurement. Type: official procurement open data. Access model: REST/API guidance / downloads. Reuse note: procurement open-data terms.

Federal procurement-cycle, supplier and purchasing-context enrichment. For CompaniesData ingestion, preserve the original URL, access date, source owner, field-level provenance and update cadence before joining it to any commercial profile.

Limitation: Procurement layer only; not the full company universe. Treat this as one evidence layer, not proof of complete coverage, official endorsement, unrestricted redistribution, beneficial-ownership completeness or contact-data permission.

6. PNCP open data

Authority: official procurement. Type: official national procurement open data. Access model: API / open data / copies of procurement data. Reuse note: PNCP open-data terms.

National public-contracting enrichment and API evidence. For CompaniesData ingestion, preserve the original URL, access date, source owner, field-level provenance and update cadence before joining it to any commercial profile.

Limitation: Procurement-only coverage. Treat this as one evidence layer, not proof of complete coverage, official endorsement, unrestricted redistribution, beneficial-ownership completeness or contact-data permission.

7. CVM open data portal

Authority: regulator. Type: securities regulator open data. Access model: downloads / datasets. Reuse note: CVM open-data terms.

Listed and regulated-market enrichment. For CompaniesData ingestion, preserve the original URL, access date, source owner, field-level provenance and update cadence before joining it to any commercial profile.

Limitation: Regulated-market subset only. Treat this as one evidence layer, not proof of complete coverage, official endorsement, unrestricted redistribution, beneficial-ownership completeness or contact-data permission.

8. CVM open-company registration dataset

Authority: regulator. Type: listed/open-company registration dataset. Access model: bulk download. Reuse note: CVM open-data terms.

Cadastro data for open/listed companies. For CompaniesData ingestion, preserve the original URL, access date, source owner, field-level provenance and update cadence before joining it to any commercial profile.

Limitation: Not all Brazilian companies. Treat this as one evidence layer, not proof of complete coverage, official endorsement, unrestricted redistribution, beneficial-ownership completeness or contact-data permission.

9. INPI open data

Authority: official IP. Type: official IP open data. Access model: open data / datasets. Reuse note: dataset-specific public terms.

Trademark, patent and IP enrichment. For CompaniesData ingestion, preserve the original URL, access date, source owner, field-level provenance and update cadence before joining it to any commercial profile.

Limitation: IP metadata is separate from company identity. Treat this as one evidence layer, not proof of complete coverage, official endorsement, unrestricted redistribution, beneficial-ownership completeness or contact-data permission.

10. GLEIF LEI records for Brazil

Authority: global official LEI system. Type: LEI API. Access model: public API. Reuse note: GLEIF API terms.

Cross-border legal-entity identifier enrichment for entities with LEIs. For CompaniesData ingestion, preserve the original URL, access date, source owner, field-level provenance and update cadence before joining it to any commercial profile.

Limitation: LEI coverage is partial and skewed toward financial/cross-border entities. Treat this as one evidence layer, not proof of complete coverage, official endorsement, unrestricted redistribution, beneficial-ownership completeness or contact-data permission.

Practical Manual, API and Bulk Options

1. CNPJ bulk route

Start with the Receita Federal CNPJ dataset and metadata. Use the metadata to map file layout, field names, company/establishment relationships, activity codes, status values and partner-related structures. Keep raw files and normalized tables separate so every derived field can be traced back to the official source.

2. Open-data catalogue route

Use dados.gov.br to discover the current dataset page, resource links and source-owner notes. Catalogue pages are useful for provenance and dataset discovery, but ingestion should rely on the resource-level data and metadata actually used.

3. Procurement API and open-data route

Use PNCP and Compras.gov.br for supplier, tender, contract and public-purchasing enrichment. Store procurement identifiers and contracting dates separately from the CNPJ legal-identity table because procurement participation is an event signal.

4. Regulated-company route

Use CVM open data for listed/open-company and market-regulated context. This is especially useful for KYB, financial analysis and issuer matching, but it covers a regulated subset.

5. IP and LEI route

Use INPI and GLEIF to add trademark, patent and legal-entity identifier evidence where present. These sources improve matching and confidence but should carry partial-coverage flags.

Held Source-Risk Findings

• IBGE CEMPRE statistics: source-relevant but timed out from this node; keep as held until a stable official statistics route passes live QA.
• Diario Oficial da Uniao search: source-relevant for corporate/legal publications but the automated route closed the connection; do not link as clean evidence in this draft.
• Transparency Portal sanctions: source-relevant for CEIS/CNEP compliance enrichment, but the recheck returned 405/human-verification behaviour; hold until browser/API route QA clears.
• Complete all-corporate-acts claim: blocked. CNPJ public data is strong but should not be described as every corporate act, every filing or every beneficial-ownership detail.
• Marketing-contact claim: blocked. Public CNPJ, procurement, regulator, IP or LEI data is not sales-prospecting permission.

Missing-Data Gaps

• Beneficial ownership: do not claim complete public beneficial-ownership coverage from the clean source set.
• Corporate acts: legal publications and registry filings can sit outside the CNPJ public-data core.
• Real-time status: bulk files and catalogue resources require update-date and ingestion-date handling.
• Contact fields: business emails, phones and outreach contacts are a separate compliant enrichment layer.
• Subnational detail: municipal/state licensing or registrations may require additional local sources not covered here.
• Sector data: CVM, INPI and GLEIF cover subsets that should not be projected onto the entire economy.

Recommended Data Model

• Entity table: CompaniesData id, CNPJ root, legal name, legal nature, status, source owner, source date and normalization version.
• Establishment table: CNPJ establishment id, trade name, address, municipality, CNAE, opening date, status and address-quality flags.
• Partner/officer table: only where lawful and necessary, with natural-person/privacy flags, role type, source date and suppression logic.
• Procurement table: PNCP/Compras identifiers, supplier CNPJ, buyer, procedure, award/contract fields and event dates.
• Regulator table: CVM identifiers, issuer names, market category, filing/source URL and regulated-subset flags.
• IP table: INPI mark/patent identifiers, owner strings, class/category, status and matching confidence.
• LEI table: LEI, legal name, address country, registration status, managing LOU and GLEIF update timestamp.
• Compliance flags: lgpd-sensitive, partner-data, contact-use-blocked, procurement-only, regulator-subset, lei-subset and manual-review-required.

CompaniesData Normalization and Enrichment Value

Brazil is exactly the type of market where source strength does not eliminate product work. CompaniesData turns raw official material into a usable business dataset by normalizing CNPJ roots and establishments, cleaning names, joining procurement and regulator signals, preserving source provenance and separating official company identity from contact-data enrichment.

For international users, the strategic route is CompaniesData.cloud because the dataset can be packaged with English documentation, stable columns, source notes and lawful-use cautions. Request a CompaniesData sample for Brazil if you need a normalized dataset rather than a list of source portals. For Spanish-speaking or Hispanic contact-data workflows, CentraldeComunicacion.es is the owned route; however, that contact-data layer remains separate from official CNPJ/open-data reuse.

Important boundary: CompaniesData can enrich Brazil company records for analysis, CRM cleanup, KYB, market research and sourcing workflows. That is not the same as saying public official records are automatically valid for cold email, phone lists, WhatsApp campaigns or unrestricted resale.

Source Matrix

Source	Owner / authority	Access model	Reuse note	Main limitation
Receita Federal CNPJ guidance	identifier / tax authority	documentation / search / downloads	official public-data terms and privacy limits	Guidance route, not a legal opinion on all reuse scenarios.
Receita Federal CNPJ open dataset	identifier / tax authority	dataset page / bulk files	dataset-specific public-data terms with LGPD caution	Large files; partner and natural-person-adjacent fields require LGPD/purpose review.
CNPJ metadata PDF	identifier / tax authority	PDF / metadata	official documentation	Metadata only; not the dataset itself.
Brazil open-data portal	official open data	catalogue / CKAN-style discovery	dataset-specific Brazilian open-data terms	Catalogue quality and freshness vary by dataset.
Compras.gov.br open data	official procurement	REST/API guidance / downloads	procurement open-data terms	Procurement layer only; not the full company universe.
PNCP open data	official procurement	API / open data / copies of procurement data	PNCP open-data terms	Procurement-only coverage.
CVM open data portal	regulator	downloads / datasets	CVM open-data terms	Regulated-market subset only.
CVM open-company registration dataset	regulator	bulk download	CVM open-data terms	Not all Brazilian companies.
INPI open data	official IP	open data / datasets	dataset-specific public terms	IP metadata is separate from company identity.
GLEIF LEI records for Brazil	global official LEI system	public API	GLEIF API terms	LEI coverage is partial and skewed toward financial/cross-border entities.

FAQ

Is Brazil a strong open company data country?

Yes. Brazil is one of the strongest Latin America jurisdictions because Receita Federal publishes CNPJ public data and the ecosystem includes official procurement, CVM, INPI and LEI enrichment layers.

Is CNPJ data a complete legal-company database?

It is a strong official tax/company identifier and establishment data backbone, but it should not be described as every corporate act, all filings, every ownership detail or a complete legal-publication corpus.

Can CNPJ public data be reused commercially?

Commercial reuse depends on dataset terms, attribution, no-endorsement language, privacy controls and the exact fields used. LGPD and purpose-limitation review remain important.

Does public CNPJ data allow cold email marketing?

No. Public access to company or establishment data is not sales-prospecting permission. Email, phone and contact-role enrichment need separate lawful basis, suppression and opt-out controls.

What are the best API or bulk sources?

The practical stack is Receita Federal CNPJ public data and metadata, dados.gov.br for dataset discovery, PNCP and Compras.gov.br for procurement, CVM for listed/open companies, INPI for IP and GLEIF for LEIs.

Why are IBGE, DOU and Transparency Portal held in this draft?

They are source-relevant, but this node saw timeout, closed-connection or human-verification behaviour. They should be rechecked manually or through stable official/API routes before being linked as clean evidence.

Why use CompaniesData if Brazil has public bulk data?

Because raw official data still needs parsing, deduplication, source provenance, update tracking, field normalization, privacy flags, enrichment matching and delivery in usable business formats.

Can Brazil data be joined with private contact data?

Only through a separate compliance process. Official company identity can support lawful enrichment, but contact data requires its own lawful basis and should be documented outside the official-source reuse claim.

Official Sources

• Receita Federal CNPJ guidance – identifier / tax authority
• Receita Federal CNPJ open dataset – identifier / tax authority
• CNPJ metadata PDF – identifier / tax authority
• Brazil open-data portal – official open data
• Compras.gov.br open data – official procurement
• PNCP open data – official procurement
• CVM open data portal – regulator
• CVM open-company registration dataset – regulator
• INPI open data – official IP
• GLEIF LEI records for Brazil – global official LEI system