The lower House of Deputies had passed the bill earlier, and the Senate approved it later yesterday, leaving only the expected signature into law from President Dilma Rousseff.
"The law is aimed at balancing freedom of expression and the web-users' rights to privacy and protection of personal data," Rousseff said.
The government-backed law stopped short of requiring companies such as Google and Facebook to store local users' data in Brazilian data centres.
Rousseff, in the past, has spoken out forcefully against cyber-snooping revealed by US intelligence whistleblower Edward Snowden who now lives in Russia. The US eavesdropping targeted her staff's communications and those of others at Petrobras, the state oil giant.