ANPD Publishes Regulation on International Data Transfers to Strengthen Data Protection in Brazil

On August 23, 2024, the Brazilian Data Protection Authority (“ANPD”) published the Resolution No. 19/2024 in the Federal Official Gazette, approving the Regulation on International Data Transfers. This regulation sets forth the rules and procedures for the transfer of personal data to other countries, in compliance with the Brazilian Data Protection Regulation (“LGPD”).

The publication of this regulation represents a significant milestone for data protection in Brazil, especially in the context of increasing global operations. The ANPD aims to ensure the protection of Brazilian citizens, even when they are transferred abroad, providing broader legal security for Brazilian companies engaged in international trade.

The Regulation defines the use of standard contractual clauses, which must be fully adopted in contracts between data exporters and importers. These clauses establish safeguards for data protection during international transfers, and the full text to be implemented is provided in its Annex II.

Moreover, ANPD may recognize standard clauses of other countries or international organizations as equivalents, facilitating consistency in global data protection practices. Binding corporate rules have also been regulated, allowing transfers between organizations within the same economic group, as long as they comply with LGPD requirements.

The Resolution is the result of a regulatory process started in 2022, which included public consultations and hearings with more than 1,700 contributions from society. The regulation came into effect on the date of its publication, and data processing agents have up to 12 months to adapt their contracts to the new standard clauses approved by ANPD.

Our Digital Law team is closely monitoring all developments on this matter, as well as its impacts in Brazil. If you would like to receive more information on this topic, please contact us at digital@kasznarleonardos.com.