Employer of Record (EOR) in Brazil: Costs, CLT Risks, IP, & Compliance

An employer of record (EOR) in Brazil can hire employees for a foreign company that does not yet have a local entity. In the intended structure, the named local company legally employs workers, signs the local employment contract, runs BRL payroll, administers statutory obligations, and reports the employment. The client usually selects the person and manages the commercial work.

That operating model allows entry without first forming its own legal entity in Brazil. Employment, tax, IP, and privacy exposure still turns on the exact Brazilian employer, written agreements, allocation of direction, payroll evidence, and day-to-day conduct.

When an EOR in Brazil fits

An EOR is strongest when a company needs a modest employee cohort, wants to enter Brazil without building an entity first, and accepts a third party as the legal employer. It can also work as a transition route while an owned entity is being evaluated.

An EOR is less attractive when the workforce will be large and permanent, the company needs local licenses or revenue activity, benefits and equity require deep customization, local leaders will hold broad commercial authority, or cumulative fees and operating restrictions exceed entity costs.

The guide to hiring software developers in Brazil compares EOR employment with vendor, entity, and contractor routes. When working-hour alignment within Latin America is part of the decision, evaluate the operating fit described in nearshore software development in Brazil separately from the employment vehicle.

For talent and provider context, GSC’s Brazilian developers page can help separate direct team building from managed software-vendor selection. An EOR employs people. Product delivery, architecture, QA, and project outcomes remain with the client unless a separate service agreement says otherwise.

EOR vs entity, payroll provider, and outsourcing models

The legal employer, the buyer’s control, and the purchased outcome change across these models. A buyer purchasing a delivery outcome should compare software companies under a managed-service model; a buyer assembling its own team should compare employment structures. Use the distinctions below before asking providers for prices.

The broader guide to outsourcing to Brazil examines how managed delivery and embedded-team models change vendor responsibility. Do not assume temporary or contract workers fall under the same structure; temporary work and independent contracting require their own analysis.

What Brazilian labor law says about EOR

The statutes reviewed for this guide do not create a standalone, universal “EOR” category or safe harbor. Brazilian labor law applies to the actual employment and service relationships rather than the commercial label.

Law 6,019 permits a private legal entity with compatible economic capacity to provide services, including activities connected to a client’s core business. Under article 4-A, the provider hires, pays, and directs its workers or may subcontract. Article 5-A permits the client to engage the service, restricts workers to the contracted activities, and gives the client subsidiary liability for labor obligations during the service period. Article 5-B requires a written agreement identifying the parties, services, term where applicable, and value.

That framework creates a diligence issue. Commercial EOR descriptions often say the client directs daily work, while the service-provider statute assigns direction to the provider. The label alone doesn’t resolve the tension. Have Brazilian counsel review the proposed structure, employment documents, responsibility matrix, and actual management practices.

The CLT also matters. Articles 2 and 3 define employer and employee. Article 6 treats remote supervisory means as equivalent for subordination, and article 9 voids acts intended to evade the CLT. A provider’s promise of “zero risk” or “100% liability transfer” cannot override the law. Counsel should test the CLT and other local laws against the provider’s documents and conduct, including any applicable collective instruments.

EOR workforce management from onboarding to exit

Before an EOR can onboard employees, the local employer needs enough authority and information to perform real employer duties.

1. The candidate and client agree the role, compensation, location, schedule, and proposed start, subject to local-employer approval.

2. The named Brazilian entity issues the employment contract and determines the employing establishment, worker category, and applicable collective terms.

3. The employer completes admission reporting. The general eSocial manual says the S-2200 event is normally due no later than the day before work begins; S-2190 can be used as a preliminary event where handled correctly.

4. The employer runs BRL payroll to pay employees and handles withholdings, contributions, benefit administration, payslips, time and leave records, occupational steps, and required filings.

5. The client manages product priorities under a written authority matrix, while employer decisions remain with the EOR where required.

6. Changes to compensation, location, hours, leave, discipline, accommodation, or termination go through local review before the client acts.

7. Offboarding combines statutory payroll and documents with access removal, equipment return, IP and repository handover, data deletion, and evidence of final filings.

A platform workflow should reflect those steps. A client shouldn’t be able to terminate a Brazilian employee instantly without legal review, funding, and a local completion plan. For the client-managed working relationship, working with Brazilian software teams requires explicit feedback, escalation, meeting, and decision rules.

Brazil employer costs and EOR fees

An EOR quote has three separate layers: employee remuneration; statutory employer costs and mandatory benefits; and the provider’s commercial charges. Optional employee benefits and benefits administration fees must be itemized separately. Use Brazil payroll and employment costs to model statutory benefits and employer costs; each commercial quote still needs its own assumptions.

Public global pricing pages checked on August 3, 2026 showed these headline EOR fees. They provide global comparison anchors; a Brazil-specific all-in quote requires the local assumptions listed below.

Pricing sources: Deel pricing, Remote pricing, Oyster pricing, and Papaya Global pricing.

Separate these commercial terms in every quote:

• exact local employer and whether it is provider-owned or a partner;

• management fee, minimum term, annual commitment, volume discount, and indexation;

• salary-funding and invoice currencies, FX source, spread, timing, and correction process;

• deposits, statutory accruals, severance reserves, refund timing, and segregation;

• onboarding, background check, benefits, equipment, equity, amendment, off-cycle, and offboarding fees;

• included employee support, HR, payroll, and legal help;

• payroll cutoff, late funding, correction SLA, and service credits;

• liability cap, carve-outs, indemnities, insurance, and claims control; and

• transition, data export, employee transfer, and termination assistance.

Cost illustration for full-time employees

Even for full-time employees, Brazilian employment load varies with the employer, worker, tax regime, benefits, collective terms, and termination assumptions. A narrow calculation can show the mechanics if the exclusions remain visible.

Use software developer salaries in Brazil to inform the role-specific compensation input, then apply the selected employer’s statutory and contractual assumptions.

For 12 monthly base salaries, one full thirteenth-salary month plus the one-third-month vacation premium equals 1.3333 additional monthly salaries, or 11.11% of the 12-month base, before social contributions, FGTS, benefits, collective terms, EOR fees, and termination.

The following example assumes R$10,000 monthly base pay, a full qualifying year, a general 20% employer social contribution, RAT of 1% to 3%, and 8% FGTS. For simplicity, the contributions are applied to the R$133,333 subtotal. The sensitivity illustration cannot serve as a provider quote.

The illustration excludes third-party contributions, FAP effects, substituted or special tax regimes, benefits, transport, meal allowances, health coverage, collective-agreement items, occupational programs, equipment, reimbursement, leave coverage, bonuses, commissions, payroll-provider or EOR fees, FX, reserves, and termination. An actual model needs the employer’s tax regime and the role’s applicable collective terms.

Payroll tax and ongoing compliance management

Require the provider to explain how each payroll tax and employment rule becomes a control and show anonymized evidence.

Brazil’s paternity-leave rules need date control in any 2027 workforce plan. The current five-day entitlement continues through December 31, 2026. Law 15,371/2026 takes effect on January 1, 2027 and schedules 10 days in 2027, 15 in 2028, and 20 in 2029 only if the law’s fiscal condition is met. The EOR should update leave, payroll, and job-protection controls before each stage takes effect.

The 2026 minimum wage is R$1,621. The current employee INSS schedule uses progressive 7.5%, 9%, 12%, and 14% bands up to a contribution ceiling of R$8,475.55. Those employee deductions sit separately from the employer’s 20% general baseline.

Collective bargaining agreements and conventions are not optional fine print. Ask the EOR to identify the employing establishment, worker category, union coverage, and current instrument in the Ministry of Labor’s Mediador system.

IP, confidentiality, and software-delivery control

Software Law 9,609 article 4 gives the employer or service buyer a scoped default for software produced within covered duties or the contract’s R&D purpose, unless agreed otherwise. Independently created software unrelated to the contract and produced without listed employer or buyer resources can remain with the creator.

The agreement still needs a documented chain from worker to EOR to client. Foreground code, background tools, inventions, open-source approval, third-party materials, moral-rights treatment where relevant, repositories, credentials, documentation, and help at exit all belong in its schedule.

For product continuity, keep repositories, cloud tenants, signing keys, domains, issue tracking, and CI/CD under client-controlled access where practical. The EOR employment agreement and client services agreement should not contradict each other.

LGPD and security duties

EORs process employee, candidate, payroll, benefits, tax, and often device or access data. Map each purpose before assigning controller and operator labels. The ANPD’s guidance treats those roles as factual.

The dedicated guide to LGPD due diligence covers software-outsourcing controls, while an EOR review also needs to account for employee and payroll data flows.

The data processing agreement should cover processing instructions, lawful purpose, data subjects and fields, subprocessors, hosting, security, international transfer, access requests, retention, deletion, audit, and incident handling.

Where an incident may cause relevant risk or damage, the controller currently has three business days to notify the ANPD and affected data subjects. The EOR must notify the client on a shorter clock so the client can investigate, decide, and meet any external duty. Giving the provider the full three business days is unsafe.

Resolution 19/2024 governs transfer mechanisms including adequacy, ANPD standard clauses, equivalent clauses, specific clauses, and binding corporate rules. At the research check, the EU had an ANPD adequacy decision under Resolution 32/2026, while the ANPD repository showed no approved equivalent clauses, specific clauses, or binding corporate rules. Recheck the repository immediately before publication and contracting.

Permanent establishment and entity transition

An EOR does not automatically remove permanent-establishment risk. The analysis depends on the foreign company’s residence, activities, worker authority, place of business, duration, and any applicable treaty.

The official Brazil and US treaty lists do not show a comprehensive Brazil-US income-tax treaty. US companies should not rely on a generic treaty day count. Local commercial authority, sales activity, contracting, and management roles deserve specific tax review.

Compare an owned entity when the team becomes durable or large, local revenue or licenses matter, benefits and equity need more control, or local leadership gains broader authority. There is no universal employee-count breakeven. Build a three-year scenario from written EOR quotes and a Brazil entity, accounting, legal, HR, and payroll estimate.

Employer of record due diligence checklist

Verify documents at their issuer rather than accepting screenshots as the final check.

Corporate evidence and local expertise

Evidence of local expertise comes from verifiable documents, not generic assurances. Before signature, map the local-employer chain and identify the local labor laws and collective terms used for the proposed employee.

• exact legal name, CNPJ, address, CNAE, ownership, directors, and employee count;

• current CNPJ status, federal tax certificate, labor-debt certificate, and FGTS regularity;

• capital evidence if Law 6,019 is relied on;

• insurance, financial condition, payroll-funding controls, continuity, and insolvency plan; and

• every in-country partner or subcontracting layer.

HR support, workforce management, and payroll evidence

Claims of compliant employment contracts need support from anonymized operating records that connect the contract to actual compliance.

• employment contract, payslip, payroll register, eSocial admission, FGTS deposit, and remittance reconciliation;

• collective-agreement determination method;

• hours, overtime, leave, benefits, expenses, equipment, safety, discipline, grievance, and termination matrix;

• payroll accuracy and correction SLA; and

• claims history and remediation process under appropriate confidentiality.

Technology, IP, privacy, and exit evidence

The provider should prove control of the information and handover chain.

• employee confidentiality and IP documents linked to the client assignment;

• processing map, role analysis, subprocessors, hosting, transfer mechanism, and retention;

• recent security evidence, scoped certifications, access controls, encryption, logging, backups, testing, and incident exercises;

• client-notification SLA shorter than the external LGPD deadline; and

• data, payroll, and document exports plus deletion certification.

Red flags

Treat these statements or omissions as stop conditions until resolved:

• refusal to name the Brazilian employer and CNPJ;

• an unexplained partner or subcontracting chain;

• “zero legal risk,” “100% liability transfer,” or “EOR eliminates PE”;

• no collective-agreement analysis;

• no evidence of eSocial, payslips, FGTS, and remittance reconciliation;

• all-in pricing that omits FX, reserves, benefits, or termination;

• immediate platform termination without local review and funding;

• a generic global IP clause without worker-to-EOR-to-client transfer;

• a DPA that omits subprocessors, transfer mechanism, or rapid incident escalation; or

• country-template legal content with obvious factual errors.