Individual Taxpayer Registry

The Individual Taxpayer Registry (CPF) is Brazil's national system for assigning and maintaining unique identification numbers for individual taxpayers. Operated as a core component of the country's tax administration, it serves as a mandatory identifier for all fiscal obligations and has become a ubiquitous general identification tool across Brazilian society. The registry's primary function is to track and manage taxpayer records for the Federal Revenue Service, but its application extends deeply into the private sector, where it is routinely required for banking transactions, employment registration, credit applications, and commercial contracts. This widespread adoption makes the CPF number a fundamental piece of infrastructure for virtually all formal economic and legal interactions involving individuals within Brazil. The system's design ensures each number is unique and permanently linked to an individual's full legal name and date of birth, providing a standardized reference that simplifies identity verification for countless daily processes.

The scale of the CPF registry is vast, effectively encompassing the majority of Brazil's adult population, a fact underscored by the 2021 data breach that exposed approximately 223 million individual records. This incident, involving the theft and attempted sale of CPF numbers alongside corporate taxpayer (CNPJ) data, demonstrated the registry's comprehensive reach and the immense volume of sensitive personal information it consolidates. Its distinguishing attribute is this dual role as both a precise tax administration instrument and a de facto national identity document, a position enforced by legal and commercial necessity rather than explicit constitutional designation. The registry's data is considered highly sensitive due to its use in establishing financial history and legal identity, making it a prime target for cybercriminals seeking to commit fraud or identity theft. Consequently, the security and integrity of the CPF database are critical to the stability of Brazil's financial system and the protection of citizen privacy.

As a government-administered database, the CPF operates under the authority of Brazilian federal tax law, with its management and data governance policies dictated by the Federal Revenue Service. Its structure is that of a centralized, state-run registry, and it does not function as a commercial entity or subsidiary but as a public service infrastructure. The 2021 breach, orchestrated by hackers who illicitly acquired the records through online channels, highlighted systemic vulnerabilities and the profound national risk associated with compromising such a central identifier. Despite this event, the CPF remains an indispensable and non-optional element of Brazilian civic and economic life, required for everything from receiving a salary and opening a bank account to accessing government services and executing legally binding agreements. Its pervasive integration into both public administration and private industry confirms its status as a foundational pillar of the nation's operational framework.