Every business decision is only as reliable as the data behind it. Approving a registration, granting credit, onboarding a partner or meeting a KYC/AML obligation all depend on correct, complete and current information. This guide explains, in practical terms, how CPF and CNPJ registration-data lookups work in Brazil.
What registration data is and why quality matters
Registration data identifies an individual (CPF) or a company (CNPJ) in the official records: name or legal name, registration status, ownership structure, address and other attributes. It underpins nearly every onboarding, risk-analysis and fraud-prevention process. When the data is wrong or outdated, the problem spreads: registrations approved with incorrect information, credit decisions on a stale snapshot and false positives in anti-fraud. That is why data quality — origin, currency and completeness — is the first risk control of any operation.
Official sources vs. leaked databases: the difference that defines risk
- Official-source lookups: information obtained directly from the competent authorities’ records, at request time, reflecting the registry as it is today.
- Static or leaked databases: data packages copied in the past — often illicitly sourced — that circulate outdated, incomplete and without any integrity guarantee.
The distinction is not only technical, it is legal. Using data of dubious origin transfers risk to the consumer. We go deeper in the guide on the risk of leaked databases.
Real-time data (D+0): what it is and why it changes everything
D+0 describes a lookup that returns today’s data, not an old file. Each request reflects the current state of the record at the official source. In practice: less fraud, more precise credit decisions and a registration that matches reality. See the guide on real-time data (D+0).
How the LGPD governs registration-data lookups
Brazil’s LGPD does not forbid lookups — it governs how processing must occur:
- Legal basis: notably legitimate interest, applicable to legitimate purposes such as registration validation and fraud prevention.
- Purpose, adequacy and necessity: processing for a specific, adequate purpose limited to what is necessary — the minimization principle.
- Legitimate expectation and balancing: the data subject’s reasonable expectation is assessed and safeguards are applied.
Mature providers keep audited governance — for example, ISO/IEC 27001, 27701 and 37301 and adherence to the LGPD and GDPR.
Best practices for choosing a data provider
- Provable origin: demand clarity about the sources.
- Currency (D+0): prefer real-time lookups at the official source.
- Governance and certifications: audited security and privacy.
- Transparent pricing and simple integration.
- Minimization: only the attributes relevant to the purpose.
Summary
Reliable data comes from an official source, is current in real time (D+0) and is processed in compliance with the LGPD. That trio separates a secure operation from a liability waiting to happen. At CPF.CNPJ, that is exactly what we deliver — since 2015. See the packages.
