Lei Geral de Protecao de Dados Pessoais — international transfer of personal data

Arts. 33-36 set out the permitted routes — an ANPD adequacy decision, specific or standard contractual clauses, binding corporate rules, seals and certificates, or one of the statutory exceptions — but for four years the mechanisms did not exist in usable form. Resolution CD/ANPD No. 19/2024 supplied them, publishing Brazilian standard contractual clauses and the rules for equivalent clauses, specific clauses, BCRs, and adequacy. The transition period for retrofitting the ANPD-approved SCCs into existing transfer agreements ended August 23, 2025, so contracts still running on generic or EU-only clauses are now out of time. Both exporter and importer bear the burden of proving compliance, and a foreign processor receiving Brazilian data as importer is itself responsible for documenting the transfer.