Data centers have ceased to be merely information technology structures and have become the backbone of digital society. Hospitals, courts, public safety systems, and tax administration depend directly on them.
Therefore, the legal debate is growing regarding whether to treat them as essential infrastructure , requiring clear rules for regulation, sustainability, and digital sovereignty to ensure efficiency, security, and public interest.
The role of data centers in the digital society.
Data centers are physical or virtual facilities that house servers, storage and network systems, as well as electrical and cooling infrastructure, responsible for storing, processing, and distributing data essential to various sectors.
Importance for public services
These structures form the backbone of the digital society, supporting services such as electronic medical records in hospitals, judicial and administrative systems in courts, public safety databases, and government tax data. Disruption of these centers could compromise essential operations and harm services to the public.
Comparison with essential traditional infrastructure sectors
In modern times, data centers have been recognized as essential infrastructure, comparable to sectors such as energy, water, transportation, and telecommunications. Unlike these physical infrastructures, data centers demand high technological density, connectivity, and redundant electricity, in addition to specific issues of digital security and data sovereignty.
data centers as essential and strategic infrastructure
In Administrative Law, essential infrastructure refers to goods or services indispensable for the continuity of state functions and collective well-being. The concept includes highways, energy, water, telecommunications and, increasingly, data centers , given their relevance to operations related to health, public safety, energy and justice.
Given this importance, there is strong evidence to support classifying data centers as strategic infrastructure . This classification recognizes the centrality of data centers in the functioning of the modern state and reflects the need for robust regulation, sovereign data protection, and control over their operation.
The legal discussion primarily involves three complementary perspectives:
- Customer service public interest and the continuity of essential services;
- A National security, given the risk of technological dependence or control by foreign entities; and
- A digital sovereigntywhich requires guarantees of secure location of sensitive data and compliance with the LGPD (Brazilian General Data Protection Law).
These dimensions reinforce the need to treat data centers not only as private assets, but as strategic elements that demand specific administrative regimes, with requirements for transparency, security, and energy sustainability.
Possible legal frameworks: concession, permit, authorization, and PPPs.
Existing legal frameworks allow for different forms of private sector participation in the provision of public services or infrastructure. In the case of data centers , it is possible to evaluate their inclusion in models such as concessions, permits, authorizations, and public-private partnerships (PPPs). Each model offers alternatives for financing, operating, and maintaining these strategic assets.
Concessions and permits
Traditional concessions involve contracting private partners to operate public infrastructure, with remuneration made by the user or the state itself. In the context of data centers , this model can be applied when the service is considered essential and there is a provision for a tariff or regular payment.
Permits or authorizations, on the other hand, prove to be inadequate due to the precarious and simplified nature of these modalities, which are incompatible with the relevance and complexity of data center infrastructure. Furthermore, the time limits and maximum values stipulated for these contracts are reduced, hindering their viability for projects of this magnitude.
PPPs as a development strategy
Public-private partnerships ( PPPs ) emerge as an efficient alternative for capital-intensive and complex management infrastructure projects. Through PPPs, the private partner finances, builds, and operates the data center , while the State guarantees periodic payments or minimum logistical demand. This structure favors the efficient allocation of risks and added value to the public service.
In Brazil, the National Bank for Economic and Social Development (BNDES) is evaluating the creation of a fund focused on investments in data centers and artificial intelligence, signaling the State's interest in financially participating in the sector.
Furthermore, the federal government plans tax breaks to attract foreign investment, conditional on the use of renewable energy and the reservation of capacity for domestic use.
Regulatory challenges: energy, environment, and green technology
Data centers represent high electricity consumption and significant water demand for their operation, which generates concern in the planning of regulated infrastructure. Large centers depend on secure and resilient sources to ensure continuous operation, especially in regions sensitive to scarce resources.
In many states, the installation of data centers requires environmental licensing, which may involve an Environmental Impact Assessment (EIA) and an evaluation of water resource use. Although there are no specific, uniform rules, and there are even reports of omissions in regulatory structuring, experts and environmental organizations are already advocating for the establishment of clear parameters.
Regulatory incentives are also being analyzed. Current debates propose simplified licensing regimes coupled with requirements for energy and water efficiency, the use of green IT practices, and the reuse of waste heat from systems. These measures aim to reduce environmental impact and promote innovation and sustainable competitiveness.
The issue of sovereignty and information security.
Locating data centers in foreign territory can create undesirable dependence on companies that control critical infrastructure and sensitive data. This dependence jeopardizes national autonomy and compromises the State's ability to oversee strategic activities.
The concept of digital sovereignty reaffirms that relevant public and business data should be under national jurisdiction. Policies of this nature advocate that information on health, security, finance, or justice be stored within the country, under state control or by national companies with strict governance criteria.
The General Data Protection Law (LGPD) and cybersecurity regulations play an essential role in this context. The LGPD requires that the processing of personal data follow clear legal principles and that the National Data Protection Authority (ANPD) oversee security practices, including in data centers.
Few laws address the specific protection of national security data, but the ANPD's regulation already represents a significant step forward in control and accountability.
Furthermore, civil society organizations advocate for a requirement that a percentage of the processing capacity of data centers located in the country be reserved for national companies, as a way to encourage technical sovereignty and reduce vulnerabilities to external influence.
These concerns reinforce the need for regulation that combines legal certainty, data protection, and digital governance strategies so that data centers can consolidate themselves as a reliable and sovereign infrastructure, capable of supporting the most critical public services.
Perspectives for the future of data center regulation in Brazil
Brazil is moving towards recognizing data centers as essential infrastructure for public services and digital sovereignty. The debate is progressing towards creating specific rules for security, transparency, and continuity, keeping pace with the growing demand for technology and artificial intelligence in the public and private sectors.
At the same time, proposals for tax and regulatory incentives are emerging to attract investments, linked to sustainability goals and the use of renewable energy. The challenge is to balance technological innovation with legal certainty and the protection of the public interest, consolidating data centers as a strategic pillar of the national infrastructure.
The closing thought
Data centers have become essential infrastructure for the 21st century, supporting strategically important public and private services. Their regulation involves challenges ranging from energy sustainability to digital sovereignty, requiring legal solutions that combine innovation, efficiency, and protection of the public interest.
For professionals who wish to deeply understand these transformations and operate confidently in this scenario, the Postgraduate Program in Administrative Law at IDP offers comprehensive and practical training, equipping specialists to face the new challenges of public administration and strategic infrastructures.
References
SENATE AGENCY. CCT debates regulation of artificial intelligence data centers. Federal Senate, May 19, 2025. Available at: https://www12.senado.leg.br/noticias/materias/2025/05/19/cct-debate-regulamentacao-de-data-centers-de-inteligencia-artificial.
MILARÉ, Édis; PINHO, João Manuel; MORAES, Melquesedeque; FREITAS, Ryan. The carbon footprint of data centers: regulatory challenges and environmental perspectives. Migalhas , April 30, 2025. Available at: https://www.migalhas.com.br/depeso/429459/a-pegada-de-carbono-dos-data-centers-desafios-e-perspectivas.
PINCER, Pedro. Environmental concerns are raised in debate on regulation of AI data centers. Rádio Senado , May 21, 2025. Available at: https://www12.senado.leg.br/radio/1/noticia/2025/05/21/preocupacoes-ambientais-sao-levantadas-em-debate-sobre-regulamentacao-de-data-centers-de-ia.
SINTTEC – Union of IT Workers. AI Data Centers Arrive in Brazil with Environmental and Energy Requirements. July 30, 2025. Available at: https://sinttec.org.br/data-centers-de-ia-chegam-com-exigencias-energeticas/.
SOARES, Ricardo. With the popularization of generative artificial intelligence, it is necessary to include data centers in environmental licensing. Jornal da USP , August 19, 2024. Available at: https://jornal.usp.br/artigos/com-a-popularizacao-da-inteligencia-artificial-generativa-e-preciso-incluir-os-data-centers-no-licenciamento-ambiental/.
