International Affairs

International Data Transfer

Resolution CD/ANPD No. 19 of August 23, 2024 (International Data Transfer Regulation) establishes procedures and rules applicable to the international transfer of personal data, in accordance with the provisions of the General Data Protection Law (Law No. 13,709 of 2018) and the Internal Regulations of the Brazilian Data Protection Authority (ANPD) and Initiative 4 of the Regulatory Agenda for the 2023-2024 biennium. The resolution aims to ensure safe and transparent international transfers of personal data, in line with fundamental rights and legal certainty, promoting economic development and the protection of data subjects.

ANPD's International Affairs Coordination (CAI/CGRII) is the unit responsible for the implementation and technical support of international data transfer mechanisms, ensuring compliance with the LGPD and assisting the Board of Directors in deliberating on such mechanisms.

The Resolution regulates some of the mechanisms foreseen by the LGPD, ensuring protection according to the standards of Brazilian legislation. They are:

• Adequacy decisions

  Decisions issued by ANPD that recognize certain countries or international organizations as having a level of data protection equivalent to that required by Brazilian law. When an adequacy decision is issued, international data transfers to these countries or organizations can take place without the need for additional international transfer mechanisms.

• Standard contractual clauses

  These are contractual clauses predefined by ANPD, which can be incorporated into already existing contracts. They establish minimum safeguards so that, even in countries where the data protection regime is different from Brazil’s, personal data continues to be protected in accordance with the standards required by the LGPD. These clauses must be implemented without modification (Annex II of the Regulation), within 12 months of the publication of the Regulation (Art. 2, single paragraph).

• Equivalent standard clauses

  These refer to standard contractual clauses approved by foreign countries or international bodies, which may be recognized by ANPD as equivalent to Brazilian standard contractual clauses. Once considered equivalent, and subject to any conditions established by ANPD, data processors and controllers may use these clauses in their international data transfers without the need to use the standard contractual clauses in Annex II of the Regulation.

• Specific contractual clauses

  They can be used in exceptional situations, where it is proven to be unfeasible to use standard contractual clauses. These clauses must offer an equivalent level of data protection to the one guaranteed by national standard contractual clauses and must be adapted to the particular circumstances of certain transfer operations. Prior approval by ANPD is required to validate the use of this mechanism.

• Binding corporate rules

  Set of internal rules adopted by organizations in the same group or conglomerate of companies to regulate the international transfer of personal data between their different entities. These rules, which must be previously approved by ANPD, ensure that all companies in the group, regardless of the jurisdiction in which they operate, respect the level of data protection required by the LGPD. These standards are especially useful for companies that operate in several countries and wish to maintain a uniform approach to personal data protection in their international operations.

Requests for the approval or review of international data transfer mechanisms must be submitted to ANPD via its Electronic Information System (SEI). This procedure aims to guarantee efficiency and security in the filing and analysis of processes, allowing companies to monitor the progress of their requests.

Based on the Regulation, the processing of requests for analysis of international data transfer mechanisms follows specific procedures:

• Adequacy decisions

  Initiated by decision of the Board of Directors (ex officio) or at the request of public entities (sole paragraph of art. 1 of Law no. 12.527, of November 18, 2011), the process is conducted by ANPD's technical area (CAI/CGRII), which analyzes the legal context, rules, security measures and institutional guarantees of the country or body in question. ANPD's Specialized Federal Prosecutor's Office issues an opinion on adequacy, and the Board of Directors decides on approval. If approved, the decision is formalized and published on ANPD’s website. Decisions can be revised or revoked according to changes in the conditions of the country or international body, ensuring continued compliance with the LGPD. To date, no adequacy decision has been issued by ANPD's Board of Directors.

• Equivalent standard contractual clauses

  The process can be initiated by the Board of Directors (ex officio) or at the request of interested parties. ANPD's technical area (CGRII/CAI) carries out a detailed analysis of the compatibility of the foreign clauses with Brazilian standards and the LGPD. The Specialized Federal Attorney's Office at ANPD issues an opinion and the request is then submitted for final deliberation by the Board of Directors. ANPD can also consult with society or hear opinions from other public administration bodies with related competencies. If approved, the clauses will be recognized by a specific resolution and published on ANPD's website, becoming valid for international data transfers, if the conditions established by the Board's decision are observed. To date, no equivalent standard contractual clause has been recognized by ANPD's Board of Directors.

• Specific contractual clauses

  The controller must submit to ANPD the full text of the clauses it intends to use, proving that they offer and prove guarantees of compliance with the principles, the rights of the data subject and the data protection regime provided for by the LGPD. Its approval by the Board of Directors is necessary for the international transfer of data to take place based on this mechanism. The approval of specific clauses will only occur in exceptional situations, i.e. when, for reasons of fact or law duly proven by the interested party, it is unfeasible to use the standard contractual clauses. The process includes a detailed analysis of the proposed provisions by CAI/CGRII and the Specialized Federal Attorney's Office, considering compatibility with Brazilian legislation and the risks and benefits involved. To date, no specific contractual clauses have been approved by ANPD's Board of Directors.

• Binding corporate rules

  They must be submitted to ANPD's approval, accompanied by a detailed description of the transfers they cover, the countries involved, and the security measures implemented. In addition, these rules must be linked to a privacy governance program that complies with the requirements of the LGPD (art. 50). After analysis by CAI/CGRII and the Specialized Federal Prosecutor's Office, the binding corporate rules will be subject to deliberation by the Board of Directors. To date, no binding corporate rules have been approved by ANPD's Board of Directors.

• What is Resolution CD/ANPD No. 19/2024?

  Resolution CD/ANPD No. 19/2024 is the International Data Transfer Regulation issued by ANPD that establishes the mechanisms for the international transfer of personal data in accordance with the LGPD. This Regulation provides for standard contractual clauses, equivalent standard contractual clauses, specific contractual clauses, binding corporate rules and adequacy decisions.

• When can specific contractual clauses be used?

  Specific contractual clauses can only be used if previously approved by ANPD. Such approval will only take place in exceptional situations, when, for reasons of fact or law duly proven by the interested party, it is impracticable to use the standard contractual clauses. These exceptional circumstances and the clauses must be submitted to ANPD for appraisal, accompanied by the relevant documentation, as provided for in the Regulation.

• How can I submit a request for approval of specific contractual clauses, equivalent standard contractual clauses or binding corporate rules?

  Requests for approval must be made through ANPD's Electronic Information System (SEI). The documentation required for the application is detailed in the Regulation and includes, among others, the full text of the proposed clauses or rules, as well as additional information proving compliance with the requirements of the LGPD.

• How do I know if a country has an adequacy decision issued by ANPD?

  ANPD will publish on its website a list of countries and international bodies that have been granted adequacy decisions by the Board of Directors. This list will be constantly updated, allowing controllers to check whether the international transfer of personal data to a particular country is covered by an adequacy decision. To date, no country or international body has been deemed adequate by ANPD's Board of Directors. For this, a specific procedure is required, as provided for in the Regulation. When such decisions are issued, this website will be updated to contain the list of countries and international organizations deemed adequate.

• How can I find out which equivalent standard contractual clauses, specific clauses and binding corporate rules have been approved by ANPD?

  ANPD will publish on this website a list of the equivalent standard contractual clauses, specific clauses and binding corporate rules approved by the Board of Directors. As with the adequacy decisions, this list will be constantly updated. To date, none of these mechanisms have been approved by ANPD's Board of Directors. This requires a specific procedure, provided for in the Regulation.

• Are adequacy decisions issued by other countries valid in Brazil?

  Adequacy decisions issued by other countries are not valid for Brazil. However, the information and analysis contained in these decisions may be considered as a subsidy for the issuance of adequacy decisions by ANPD.

• What are the responsibilities of processing agents who carry out international data transfers?

  Processing agents who carry out international transfers of personal data must ensure that these operations comply with the LGPD and the International Data Transfer Regulation, adopting the mechanisms provided for by the standard and the safeguards appropriate to the case. Among other obligations, processing agents must guarantee the exercise of rights and provide clear information to data subjects about the transfer.

• Who can submit a request for analysis of each mechanism for the international transfer of personal data?

  The Regulation specifies who is entitled to file a request for analysis by ANPD for each international data transfer mechanism. In the case of specific contractual clauses, it is the controller who requests analysis (art. 21), while for equivalent standard contractual clauses the request can be submitted by any interested party (art. 18). For binding corporate rules, the request can be submitted by organizations from the same group or conglomerate of companies (art. 25). Finally, the issuance of adequacy decisions (art. 13) can only be requested by public bodies or entities. It is worth mentioning that the procedures for issuing an adequacy decision (art. 13) or approving equivalent clauses (art. 18) may also be initiated ex officio by ANPD, by decision of the Board of Directors.

List of Specific Contractual Clauses, Equivalent Standard Clauses, Binding Corporate Rules and Adjustment Decisions approved by ANPD (Art. 31 RTCD).

Art. 31 - ANPD shall publish on its website a list of the specific contractual clauses and binding corporate rules approved, indicating the respective applicant, the date of approval and the decision handed down by the Board of Directors, as well as other information deemed necessary by the responsible technical area.

Single paragraph. ANPD shall publish the full text of specific contractual clauses in the event that such clauses can be used by other processing agents, with due regard for trade secrets.

To date, there have been no decisions by ANPD's Board of Directors on specific contractual clauses, equivalent standard clauses, binding corporate rules or adequacy decisions. In accordance with the International Transfers Regulations, this website will be updated when decisions are taken in this regard.

To access information, complaints, compliments, claims, requests and suggestions: access the Fala.br platform.