What to Do in a Dawn Raid in Brazil (2026 Response Playbook)

What should you do in a dawn raid when federal agents arrive unannounced at your Brazilian office? In 2026, the enforcement climate across Brazil has intensified, with the Polícia Federal, the Ministério Público Federal (MPF), and CADE all conducting more frequent and more complex inspections targeting corporate fraud, competition violations, and cyber-related offences. This playbook provides the immediate, step-by-step dawn raid procedure that in-house counsel, compliance officers, and C-suite executives need to protect the company, preserve evidence lawfully, and safeguard individual rights under Brazilian law. Every minute counts, and the decisions made in the first hour can shape the entire trajectory of an investigation.

What to Do in a Dawn Raid: First Hour Checklist

The first sixty minutes of a dawn raid determine whether a company emerges with its legal position intact or inadvertently hands investigators advantages that are difficult to reverse. The following numbered steps form the core of any effective response. Print this list, laminate it, and place copies at every reception desk and security station.

1. Do not panic or obstruct. Instruct all staff to remain calm. Obstruction of a lawful search is a criminal offence under the Código de Processo Penal and can escalate the situation immediately.
2. Identify the lead officer. Ask for the name, badge number, and institutional affiliation of the lead agent. Record whether they represent the Polícia Federal, Polícia Civil, MPF, or CADE.
3. Request the warrant. Ask to see the original mandado de busca e apreensão (search and seizure warrant). Do not allow the search to proceed beyond the reception area until the warrant has been produced and reviewed.
4. Activate the internal response team. Contact the designated crisis-response coordinator immediately (see contact card below).
5. Call external counsel. This is non-negotiable. External criminal defence or compliance counsel should be on-site as quickly as possible. Ask the officers to wait in a designated area until counsel arrives, but do not physically block any agent.
6. Assign shadow teams. Allocate at least one employee to accompany each officer at all times. Shadows must take detailed written notes: which rooms were entered, which documents or devices were touched, and what was said.
7. Secure the IT environment. Notify the Head of IT to initiate the pre-agreed isolation protocol (detailed below). Do not shut down or disconnect any device.
8. Suspend document destruction. Issue an immediate litigation hold. All scheduled deletions, shredding, or archival must stop across the entire organisation.
9. Restrict employee communications. Instruct staff not to discuss the raid on personal phones, messaging apps, or email until cleared by counsel.
10. Photograph and document everything. Take timestamped photographs of any materials seized, including serial numbers on devices. Request a signed copy of the auto de apreensão (seizure record) before agents leave.

Reception and Security Protocol

Reception staff are the first point of contact. They should be trained to greet officers courteously, verify identification, and direct them to a private waiting area. A sample script might read: “Good morning. We will cooperate fully. Please allow me to see the warrant and contact our legal department. May I direct you to our conference room while we arrange a liaison?” This buys critical minutes without constituting obstruction.

Who to Call: Internal Response Team Contact Card

Every company operating in Brazil should maintain a laminated, up-to-date contact card listing the following roles and their direct mobile numbers:

• Crisis Coordinator (usually the General Counsel or Chief Compliance Officer)
• CEO or Country Manager
• Head of IT / Information Security
• External Criminal Defence Counsel
• Data Protection Officer (DPO)
• Head of Corporate Communications

This card should be stored physically at reception, in the security office, and digitally in a restricted-access folder that is accessible even if company networks are seized.

Verify the Search and Seizure Warrant in Brazil

Not every document an officer presents grants the same powers. Under the Código de Processo Penal, a mandado de busca e apreensão must meet specific formal requirements. Verifying these requirements is a legal right, not an act of obstruction. The following checklist should be reviewed by counsel immediately upon receipt of the warrant.

1. Autoridade expedidora (issuing authority): Is the warrant signed by a competent judge? Confirm the court (vara or juízo) and jurisdiction match the company’s registered address.
2. Case number and date: Every valid warrant carries a case reference number and an issue date. An undated or unnumbered document is a red flag.
3. Scope, addresses and premises: The warrant must specify which physical locations may be searched. If agents attempt to search a floor or building not listed, counsel should object and record the objection in writing.
4. Scope, documents and items: The warrant should describe the categories of documents or devices subject to seizure. Overly broad language (e.g., “all company records”) may be challenged.
5. Prazo (validity period): Warrants have a defined validity period. If the date has expired, the search is unlawful.
6. Officer identification: Cross-check the agents’ credentials against any names listed in the warrant. Unidentified individuals should not participate in the search.

Warrant Red Flags and Scope Limitations

Industry observers note that warrant challenges are most effective when documented in real time. If any of the following issues arise, record the objection formally and notify external counsel immediately:

• The warrant is a photocopy without an original stamp (carimbo) or signature.
• Agents claim oral authorisation without a written warrant, under ordinary circumstances, a judicial order is required.
• The scope of the search extends beyond the premises or document categories specified in the warrant.
• Agents attempt to seize materials that appear to be protected by attorney-client privilege.

Data Preservation and IT Response During a Dawn Raid

Digital evidence is now the primary target of most dawn raids in Brazil. Servers, laptops, mobile phones, and cloud-hosted data are all within scope if the warrant permits. The IT response must balance cooperation with preservation, and with the company’s obligations under the LGPD (Lei nº 13.709/2018). Getting this wrong can expose the company to both criminal liability and data protection penalties.

Quick IT Script for the Security Operations Centre

The moment IT is notified, the following steps should be executed in sequence:

• Do not power down any device. Shutting down a server can destroy volatile data and may be treated as evidence spoliation.
• Disable automatic synchronisation and scheduled deletions. Pause any automated archival, email purge, or backup rotation scripts immediately.
• Create forensic images. Where feasible, begin imaging targeted devices using write-blocking tools before handing them over. This preserves the company’s own copy of the evidence.
• Record chain of custody. Log the serial number, make, and model of every device seized. Note the time, the officer’s name, and the condition of the device.
• Isolate but do not disconnect cloud accounts. Revoke user access tokens to prevent remote deletion by panicked employees, but do not delete any cloud-hosted data.
• Notify the DPO. If personal data of employees or third parties is likely to be accessed during the search, the Data Protection Officer must be informed immediately to assess LGPD obligations.

LGPD and Evidence: When Data Can Be Shared

The LGPD does not override a valid judicial warrant, but it does impose constraints on how personal data is handled. Companies should apply a principle of data minimisation: provide only what the warrant specifically demands, and flag any personal data that falls outside the warrant’s scope. If agents access personal data that is unrelated to the investigation, this should be recorded and raised with counsel.

Where large volumes of personal data are seized, for example, a complete email server, the likely practical effect will be a requirement to notify the Autoridade Nacional de Proteção de Dados (ANPD) under LGPD incident-reporting provisions if the seizure creates a risk to data subjects. The DPO should begin this assessment within hours of the raid, not days.

Executive Rights and Privilege During a Dawn Raid

How to deal with a dawn raid at the executive level requires a careful balance between cooperation and self-protection. Under Brazilian law, no individual is obliged to produce evidence against themselves, a constitutional protection under Article 5, LXIII of the Federal Constitution. However, the boundaries of this right are frequently tested during live operations.

Industry observers expect that the most common mistake executives make is speaking too freely. The recommended conduct is straightforward: confirm your identity, your role within the company, and nothing more until external counsel is present. Do not volunteer explanations, offer opinions about the investigation, or attempt to justify the company’s actions on the spot.

How to Handle Requests for Executive Documents and Emails

Attorney-client privilege (sigilo profissional) is recognised under the Estatuto da Advocacia (Lei nº 8.906/1994). Communications between a company and its external legal advisers are protected. However, the position of in-house counsel is more nuanced, early indications suggest that Brazilian courts may apply a narrower privilege to in-house legal communications than to external counsel advice, particularly where the in-house lawyer also performs business functions.

When agents request documents that may be privileged:

• Do not hand them over. Identify and physically separate any materials that may be covered by privilege.
• Create a privilege log. Record the date, author, recipient, and subject of each document withheld, along with the basis for the privilege claim.
• Present the privilege log to counsel. External counsel will assess whether to formally challenge the seizure before the issuing court.
• Never delete or conceal materials. Destruction of potentially relevant evidence constitutes a separate criminal offence and will undermine any privilege argument.

CADE Dawn Raids vs Criminal Searches: Practical Comparison

Not all dawn raids are criminal. Competition dawn raids in Brazil conducted by CADE operate under an administrative framework and carry different powers, limitations, and response implications. Understanding the distinction is critical because the wrong response to a CADE inspection, such as treating it as a criminal search, can either escalate the situation or lead to inadvertent waiver of rights.

CADE Inspection Checklist: What Not to Do

During a CADE dawn raid, companies should avoid the following errors:

• Do not refuse access entirely. CADE has the power to inspect premises and copy business documents. Blanket refusal can result in obstruction penalties.
• Do not allow unsupervised access. Assign a shadow to every CADE inspector, just as with criminal agents.
• Do not allow interviews without counsel. Employees are not obliged to answer CADE’s questions on the spot, arrange for counsel to be present before any substantive discussion.
• Do not provide documents outside the stated scope. If CADE inspectors request materials unrelated to competition matters, note the request and defer to counsel.

Post-Raid Steps: Documentation, Preservation, and Remediation

What to do after a dawn raid is nearly as important as the response during it. The first 72 hours set the foundation for the company’s legal strategy, whether that involves challenging the warrant, negotiating with prosecutors, or mounting a defence.

Template Post-Raid Timeline: First 24–72 Hours

• Hour 0–2 (immediately after agents leave): Gather all shadow notes, photographs, and copies of the warrant and auto de apreensão. Conduct a debrief with the internal response team and external counsel.
• Hour 2–12: Prepare a detailed internal incident report covering: which premises were searched, which documents and devices were seized, which employees were interviewed, and any objections raised.
• Hour 12–24: Issue formal preservation notices to all custodians across the organisation. Engage a forensic IT vendor to verify evidence integrity and begin imaging any devices not already captured.
• Day 1–3: Conduct a privilege review of all materials seized. If privileged documents were taken, instruct counsel to file an immediate challenge with the issuing court. Assess LGPD notification obligations with the DPO. Prepare an external communications plan for clients, regulators, and media if necessary.
• Day 3–7: Initiate or formalise an internal investigation. Preserve all communications related to the raid. Begin strategic assessment of cooperation, settlement, or defence options with counsel.

Early indications suggest that companies that document the raid comprehensively and challenge warrant irregularities within the first few days are significantly better positioned in subsequent proceedings.

Preparation: Dawn Raid Policy, Training, and Prompt Cards

The best response to a dawn raid is one that has been rehearsed. A comprehensive dawn raid policy should be a standing document in every Brazilian operation, reviewed and updated at least annually. Dawn raid training, including tabletop exercises that simulate a live inspection, should be conducted at least once per year for reception, IT, compliance, legal, and executive teams.

What Your Dawn Raid Policy Must Include

At a minimum, the policy should cover these six elements:

• Response team roles and contact details, updated quarterly.
• Reception protocol, scripted instructions for front-desk staff.
• Warrant verification checklist, printed and accessible at reception and in the General Counsel’s office.
• IT isolation script, step-by-step instructions for the SOC/IT security team.
• Privilege identification process, who assesses privilege, where to store privilege logs, and how to escalate disputes.
• Post-raid documentation template, a standardised form for recording all actions taken during the search.

Consider distributing laminated prompt cards to all relevant teams. A one-page “First Hour” card summarising the ten core steps, and a separate “IT Quick Script” card for the security operations centre, can make the difference between a controlled response and chaos.

Conclusion: What Should You Do in a Dawn Raid, Act Now, Prepare Always

A dawn raid in Brazil is a high-stakes event where minutes matter and mistakes compound. The 2026 enforcement landscape makes preparation not merely prudent but essential. Companies that invest in a clear dawn raid policy, train their teams regularly, and maintain current response protocols will be far better positioned to protect their interests. When agents arrive at the door, the question is not whether you have a plan, it is whether your people can execute it under pressure.

Sources

1. CADE (Conselho Administrativo de Defesa Econômica), Official Site
2. Lei Geral de Proteção de Dados (LGPD), Lei nº 13.709/2018
3. Código de Processo Penal, Official Text
4. Polícia Federal, Official Site
5. Ministério Público Federal, Official Site
6. Loyens & Loeff, What to Do in an Event of a Dawn Raid
7. Norton Rose Fulbright, Keeping Your Dawn Raid Guidance Current
8. Brabners, Dawn Raids: A Practical Guide
9. International Competition Network, Dawn Raids Training
10. Webber Wentzel, Quick Reference Guide: What to Do in a Dawn Raid