Brazil Company Lookup: Confidentiality as a Numbered Document

A Brazil company lookup runs through the CNPJ — the Cadastro Nacional da Pessoa Jurídica — administered by the Secretaria Especial da Receita Federal do Brasil (RFB). REDESIM is the integrated federal, state and municipal network for company registration and legalisation, and the Juntas Comerciais are the state commercial registries. Open data sits on dados.gov.br and receita.economia.gov.br. This guide covers a document that draws the line around what is released, a scope that catches matchers, and how the bulk file actually works. If you need the Brazilian population rather than one company at a time, the Brazil company directory covers the same registered entities with industry, size and contact breakdowns attached, and the Brazil business database is the same file described as a dataset.

Brazil company lookup: the short version

• The CNPJ is a database managed by the RFB, storing registration information on legal persons and other entities of interest to the tax administrations of the Union, the States, the Federal District and the Municipalities. Update frequency: monthly.
• The open-data page carries Nota Técnica RFB/Cocad nº 47, de 13 de maio de 2024, which assesses the confidentiality of the information in the CNPJ open data — with a later note amending it.
• The CNPJ covers arrangements without legal personality too: condominiums, public bodies, funds. A CNPJ is not evidence of a company.
• The download is split into smaller parts, and reading it requires knowing the layout.

The line is a document, with a number and a version history

Most registers in this series leave you to discover the boundary of an open dataset by inspection — you download it, you look at what is there, and you infer what was withheld. Brazil publishes the boundary as an instrument.

The dataset page carries Nota Técnica RFB/Cocad nº 47, de 13 de maio de 2024, which "trata da avaliação de confidencialidade das informações constantes nos Dados Abertos do Cadastro Nacional da Pessoa Jurídica (CNPJ)" — it deals with the assessment of the confidentiality of the information contained in the CNPJ Open Data. And a later note amends it.

What that gives a reader is different in kind from a field list. The line between what is released and what is withheld is documented, citable, and has a version history. You can point at it. You can tell when it changed. You can ask what the amendment did.

This page does not say what the note concludes. What is sourced is its title and its stated subject — not its content. Which fields it protects, on what reasoning, and what the amending note altered are all unestablished here, and inferring them from a title would be exactly the confident guess this series exists to avoid. BRAZIL_REPORT.md records it.

A different axis from the others

Six European registers in this programme state what a user may do with the data they publish. The Czech Republic company lookup guide covers a statute defining open data as unrestricted in manner and purpose; the Belgium company lookup guide restricts purpose; the Hungary company lookup guide restricts volume; the Norway company lookup guide restricts combination; the Lithuania company lookup guide attaches a licence; the Estonia company lookup guide places GDPR obligations on the reuser.

Brazil adds something that is not a seventh answer to the same question. Those six govern what you may do with what you were given. Brazil's note governs what the state decided to include in the first place, and why — and it does so as a numbered, dated, amendable instrument.

Different axis, not a ranking. A register can have both, or neither, and the two say nothing about each other.

A CNPJ is not evidence of a company

The scope sentence is a matching trap, and it is worth quoting because the temptation is to skim it:

"O CNPJ compreende as informações cadastrais de pessoas jurídicas e outros tipos de arranjo jurídico sem personalidade jurídica (como condomínios, órgãos públicos, fundos), ou seja, informações cadastrais das entidades de interesse das administrações tributárias da União, dos Estados, do Distrito Federal e dos Municípios."

The CNPJ comprises the registration information of legal persons and of other types of legal arrangement without legal personality — such as condominiums, public bodies and funds — that is, the registration information of entities of interest to the tax administrations of the Union, the States, the Federal District and the Municipalities.

Condominiums, public bodies and funds carry CNPJs. So a CNPJ in a dataset tells you an entity is of interest to a tax administration. It does not tell you the entity is a company. Any count, coverage rate or match built on "has a CNPJ ⇒ is a business" is built on something the RFB does not say.

The register's own description sets the same frame: "O Cadastro Nacional da Pessoa Jurídica (CNPJ) é um banco de dados gerenciado pela Secretaria Especial da Receita Federal do Brasil (RFB), que armazena informações cadastrais das pessoas jurídicas e outras entidades de interesse das administrações tributárias […] A periodicidade de atualização dos dados é mensal." — a database managed by the RFB storing registration information on legal persons and other entities of interest to the tax administrations, with a monthly update frequency.

The CNPJ's administration sits with the RFB; it was created on 1 July 1998 by Instrução Normativa SRF nº 27/1998 and is regulated by Instrução Normativa RFB nº 1.863/2018, amended by Instrução Normativa RFB nº 2119, de 06 de dezembro de 2022.

What a Brazilian company register entry contains

A self-contained summary. Brazil's national register of legal persons is the CNPJ, Cadastro Nacional da Pessoa Jurídica, a database managed by the Secretaria Especial da Receita Federal do Brasil (RFB) storing registration information on legal persons and other entities of interest to the tax administrations of the Union, the States, the Federal District and the Municipalities, with a monthly data update frequency. The CNPJ comprises the registration information of legal persons and of other types of legal arrangement without legal personality, such as condominiums, public bodies and funds. Its administration is the responsibility of the RFB; it was created on 1 July 1998 by Instrução Normativa SRF nº 27/1998 and is regulated by Instrução Normativa RFB nº 1.863/2018, amended by Instrução Normativa RFB nº 2119 of 6 December 2022. The dataset page carries Nota Técnica RFB/Cocad nº 47 of 13 May 2024, which deals with the assessment of the confidentiality of the information contained in the CNPJ Open Data, together with a later note amending it. The API Consulta CNPJ provides three services, corresponding to three types of query, which differ in the number of fields returned. The public CNPJ data is available for download; to make downloading easier the file has been divided into smaller parts, and reading the file requires knowing the layout. Through REDESIM, consultation covers a company's data including information on the quadro de sócios e administradores and its cadastral situation before the Receita Federal; where a company has been closed, a certidão de baixa can be issued; a Consulta CNPJ por Nome Empresarial ou Nome Fantasia allows finding a CNPJ from a name; and REDESIM also offers protocol tracking and validation of the authenticity of CNPJ certificates. This summary does not describe what the Nota Técnica concludes, or what fields any of the three API services returns, because neither was established from the sources read on the date shown.

Three services, differing by field count

The API's structure is described with unusual precision, and the precision is the whole of what is sourced:

"A API Consulta CNPJ disponibiliza três serviços, correspondentes a três tipos de consultas, que se diferenciam pelo número de campos retornados."

The Consulta CNPJ API provides three services, corresponding to three types of query, which differ in the number of fields returned.

That is the distinction: not by entity type, not by access level, not by freshness — by how many fields come back.

What the three tiers are called, what fields each returns, and what access conditions apply are not described here. The source states the axis of difference and nothing else.

The download, and the layout

Two facts about the bulk file, and the second is the one that costs people an afternoon:

"Os dados públicos do CNPJ estão disponíveis para download. Para facilitar o download o arquivo foi dividido em partes menores. […] Para realizar a leitura do arquivo, é necessário conhecer o layout."

The public CNPJ data is available for download. To make downloading easier, the file has been divided into smaller parts. And to read the file, it is necessary to know the layout.

A reader who downloads the CNPJ without the layout document has a set of files they cannot parse. The split into parts is a convenience; the layout requirement is a dependency. Fetching the data and obtaining the layout are two separate steps, and only one of them is a download.

Where a Brazil lookup stops

REDESIM is the other door, and it answers different questions. Its consultation covers a company's data "inclusive informações do quadro de sócios e administradores e a situação cadastral perante a Receita Federal" — including information on the partners and administrators and the cadastral situation before the Receita Federal. Where a company has been closed (baixada), a certidão de baixa can be issued. A Consulta CNPJ por Nome Empresarial ou Nome Fantasia finds a CNPJ from a business name or trade name. And REDESIM offers protocol tracking and validation of the authenticity of CNPJ certificates.

Named as REDESIM names them; none described beyond that.

The federal/state split is the frame for all of it: the RFB administers the CNPJ, REDESIM integrates federal, state and municipal registration, and the Juntas Comerciais are the state commercial registries. How work passes between them is not described here — and that omission is deliberate rather than incidental. BRAZIL_REPORT.md flags it, because if changes to partners and administrators pass through a state Junta before reaching the RFB, that is a latency fact of exactly the kind this series names, and it is not sourced.

Where the question is a population rather than a company, a firmographic directory covers the same registered entities with classification, size and contact data attached and queryable as a set; the Americas company directory breaks the regional file down by market.

Data quality pitfalls to avoid in Brazil

Treating a CNPJ as evidence of a company. The register comprises legal persons and arrangements without legal personality — condominiums, public bodies, funds.

Assuming what the confidentiality note withholds. Its title and subject are sourced; its conclusions are not.

Downloading the bulk file without the layout. Reading it requires knowing the layout, and that is a separate dependency from the download.

Expecting the API tiers to differ by access. The stated difference is the number of fields returned.

Expecting data to move faster than monthly. The RFB states the update frequency as monthly.

Assuming RFB and the Juntas Comerciais are one pipeline. How work passes between the federal register and the state registries is not established here.

A repeatable Brazil company lookup workflow

1. Establish whether a CNPJ belongs to a company or to another kind of arrangement before counting it.
2. Obtain the layout document before, not after, downloading the bulk file.
3. Plan around a monthly update frequency.
4. Use REDESIM when you need partners and administrators or the cadastral situation.
5. Request a certidão de baixa for closed companies, and use the name search to recover a CNPJ.
6. Cite the Nota Técnica when you need to state what is and is not in the open data — and read it rather than inferring it.

Frequently asked questions

What is the CNPJ?

A database managed by the Receita Federal storing registration information on legal persons and other entities of interest to the tax administrations of the Union, the States, the Federal District and the Municipalities, updated monthly.

Does a CNPJ mean the entity is a company?

No. The CNPJ also comprises arrangements without legal personality, such as condominiums, public bodies and funds.

What is the Nota Técnica on the dataset page?

Nota Técnica RFB/Cocad nº 47 of 13 May 2024, which deals with the assessment of the confidentiality of the information in the CNPJ Open Data. A later note amends it. What it concludes is not stated on this page.

How does the API differ between services?

It provides three services corresponding to three types of query, differing in the number of fields returned. The tiers themselves are not described here.

Why can't I read the downloaded file?

Because reading it requires knowing the layout. The file is divided into smaller parts to ease downloading, but the layout is a separate requirement.

Where do I find partners and administrators?

Through REDESIM, whose consultation covers a company's data including the quadro de sócios e administradores and the cadastral situation before the Receita Federal.

Can I look up a closed company?

Where a company has been closed, REDESIM can issue a certidão de baixa.

Source Register

Every Portuguese passage above is the publisher's own wording, read on the date shown, with its accents reproduced as written and an English gloss beside it rather than in place of it. No amount appears anywhere in this page's prose.

This page does not say what the Nota Técnica concludes — its title and stated subject are sourced, its content is not — and does not describe the three API tiers, the Cartão CNPJ's fields, the Simples Nacional and SIMEI regimes, Sintegra, or how work passes between the Juntas Comerciais and the RFB. BRAZIL_REPORT.md records each, and flags two first: a reported change to the CNPJ's format, which if confirmed would be a structural fact for anyone storing Brazilian identifiers and outranks everything else here for practical urgency, and the QSA update chain, which if true is a latency fact of the kind this series names.

The readings that are InfobelPRO's rather than the RFB's: that publishing the confidentiality assessment as a numbered, dated, amendable instrument makes the boundary citable and versioned rather than discoverable only by inspection; that this is a different axis from the six European reuse regimes rather than a seventh answer to the same question; that a CNPJ is not evidence of a company, so any metric built on that equivalence rests on something the RFB does not say; and that the layout is a dependency rather than a convenience, so fetching the data and obtaining the layout are two separate steps. Those are ours, and none of the comparisons is a ranking.