Has your company already defined the mechanisms for implementing International Data Transfer?

International Data Transfer

Resolution CD/ANPD No. 19/2024 regulated the international transfer of personal data processed, collected, or related to services where Brazil is the recipient country.

Following this regulation, Articles 33 to 36 of the LGPD (Brazilian General Data Protection Law) were supplemented, outlining how international transfers can be carried out and defining the mechanisms for the legal implementation of international transfers of personal data. These mechanisms are divided into (i) standard contractual clauses, (ii) equivalent standard contractual clauses, (iii) specific contractual clauses, (iv) global corporate rules, (v) adequacy decisions, and (vi) transfer to countries or international organizations that provide a level of data protection recognized by the ANPD.

Data controllers must define, among the existing mechanisms, the one that best suits their operations, including global ones.

If the use of standard contractual clauses approved by the ANPD is chosen, these must be fully incorporated into the respective contractual instruments. The deadline stipulated in the Resolution for data processing agents to update their contractual instruments expires in a few months, specifically in August 2025. In

this context, we emphasize that companies that have not yet carried out their internal processes to understand, through a mapping of their flows, which personal data processing operations involve international transfers, as well as which mechanisms will be adopted, will need to undertake a task force to define which mechanism will be incorporated into their operations, considering the remaining time for full compliance with the aforementioned Resolution and, depending on the mechanism chosen, having sufficient time to obtain prior approval from the ANPD (National Data Protection Authority), aiming to avoid non-compliance with legal and regulatory rules and mitigate the application of any administrative sanctions.

Equally important, we highlight that in addition to defining the aforementioned mechanisms, personal data controllers must publish on their website the transparency information stipulated in Article 17 of the Resolution in question.

De Vivo, Castro, Cunha e Whitaker Advogados is available to clarify any doubts related to the subject matter in question.

Check here the Resolution and Regulation cited above.

Source: ANPD