Contract intelligence

Thesis radar for technology companies

Contractor misclassification, contract lineage, NDAs, LGPD and electronic signatures. Each piece cites a primary source. This is not a legal magazine.

01

Lead

PJ contracts

STF lifts the pejotização stay only in first instance and regional labor courts

What happened

Justice Gilmar Mendes allowed cases to proceed in first and second instance. After the TRT ruling, the stay returns until Theme 1.389 (ARE 1532603). At the TST, cases remain stayed.

Costa Law reading

A tech company that staffs through PJ entities did not get a free pass. It got a window for the contract to be fully instructed. The lineage of the front page (personal nature, exclusivity, tools, hours) goes into the record now.

Open sourceSTF news
  1. 02
    PJ contracts

    CONATRAE issues a note on fraudulent pejotização in Theme 1.389

    The Human Rights Ministry published CONATRAE Public Note 001/2026. A majority of the commission (CNI voted against) expressed concern about Theme 1.389 interpretations and their impact on contract lawfulness analysis.

    The STF debate is not just retail labor litigation. It is contract design. A tech company needs to document real entrepreneurial activity, not just a CNPJ on the cover.

    Open sourceMDHC / CONATRAE
  2. 03
    LGPD

    ANPD opens a sanctioning case against Claro over data sharing with Serasa

    Indications of excessive sharing, lack of transparency and a hard-to-reach DPO. A warning covers current and future sharing contracts. The LGPD article 52 cap is a legal ceiling, not a fine already imposed.

    The data contract (purpose, necessity, legal basis, DPO) is the product. Anyone who forwards a customer base to CRM, credit or AI sits in the same family of risk.

    Open sourceANPD
  3. 04
    LGPD

    ANPD: 21 companies and agencies did not respond on the DPO

    Monitoring of 56 controllers (39 public, 17 private). 27 complied, 8 still have gaps, 21 stayed silent. The channel for data subjects and the authority is an obligation, not a footer line.

    In the MSA and DPA, a DPO clause without a working channel is an operational lie. A tech company will meet that in a large customer's due diligence.

    Open sourceANPD
  4. 05
    LGPD

    ANPD opens a sanction case after an incident affecting 500,000 patients

    Ransomware at Instituto Saúde e Cidadania (Isac). The entity claimed attackers only reached already closed contracts. ANPD said that was not proven. It is investigating security, notice to victims and the DPO.

    Data from a dead contract is still personal data. Retention, backup and incident notice are clauses, not an internal note.

    Open sourceANPD
  5. 06
    Signature

    STJ: lack of ICP-Brasil alone does not void a digital contract

    Special Appeal 2,197,156, 3rd Panel, Justice Nancy Andrighi. A loan signed on a non-ICP platform. Selfie, geolocation, documents and device use counted as acceptance of the method. A generic challenge is not enough.

    What a SaaS company must keep is not a PNG of a scribble. It is the trail: IP, device, time, hash, evidence of intent. The case is a payroll loan; the proof method carries into B2B contracts.

    Open sourceSTJ 18 Mar 2026
  6. 07
    Signature

    STJ: an electronic power of attorney without ICP can stand; doubt raises the level

    Same panel: Law 14.063 draws simple, advanced and qualified e-signatures. A private power of attorney can stand without ICP. If the judge doubts authenticity, a qualified signature can be required.

    Anyone who designs mandate, NDA and online acceptance flows picks the signature level before the fight, not at trial.

    Open sourceSTJ 31 Mar 2026
  7. 08
    Signature

    VALIDAR (ITI) does not validate an image; the ICP flow has envelope rules

    VALIDAR checks authorship and integrity of ICP-Brasil and gov.br signatures. June 2026 guidance: extra initials, several fields per signer, or mixing simple e-sign after ICP yields undetermined or failed status.

    If the contract must pass the government validator, the envelope workflow is a legal artifact. A screenshot and a scribble are not cryptography.

    Open sourceITI VALIDAR
  8. 09
    NDA and playbook

    Contract review against the house playbook, not against a chat window

    On 25 March 2026, Docusign launched an assistant that compares the agreement to the internal playbook, suggests a redline and points to the clause. Momentum pushed the same axis: agents over the corpus, not a loose chat.

    The tech company's asset is the playbook (NDA, MSA, DPA, PJ). Without a playbook, AI summarizes. With a playbook, front-page lineage becomes operations. Costa Law does not advertise a partner product; it describes the method.

    Open sourceDocusign IR 25 Mar 2026
  9. 10
    AI and data

    ANPD publishes the first report of its AI sandbox

    Cycle 1 followed Metatext, Synapse AI and Prevvine. It was setup, not full testing. The report asks for better communication with USP and a synthetic-data protocol. Next cycles: security, transparency, governance and anonymization.

    A tech company that trains or runs AI on customer data is already on the authority's radar, even in a sandbox. The processing contract and governance evidence enter due diligence.

    Open sourceANPD sandbox

Let's Talk

Your company's future starts here

Schedule a strategic conversation and discover how we can drive your business growth with legal security.

WhatsAppEmail
(11) 94198-8484contato@costalaw.com.br@costalaw.adv