What transfer mechanisms are allowed under the Brazil LGPD?
Start with scope. Document the exporter, foreign importer, controller and operator roles, countries and remote-access locations, data and people, purpose, frequency, systems, and onward recipients. Direct collection from a person in Brazil by a processing agent abroad may bring the foreign processing within LGPD Article 3, but Resolution 19/2024 classifies it as international collection rather than an international transfer.
Next, choose both layers of authority. An Article 7 or 11 basis permits the processing purpose; it does not permit the cross-border movement by itself. Match the actual flow to one Article 33 case and retain the facts that make that mechanism available.
For contractual safeguards, the in Annex II of Resolution 19/2024 may be incorporated without changing their prescribed text. Specific clauses and require prior ANPD approval. Contractual safeguards remain subject to LGPD principles, data-subject rights, security duties, accountability, and ANPD oversight.
An in ANPD Resolution 32/2026 recognizes transfers within its defined European Union and European Economic Area scope, including EU institutions and the EEA EFTA states Iceland, Liechtenstein, and Norway. The decision excludes processing exclusively for public security, national defense, state security, or criminal investigation and repression. It took effect on publication on 27 January 2026 and must be reassessed within four years, while ANPD continues to monitor the level of protection. Verify the current decision and the importer's coverage before using this route.
Article 33 also permits specified non-contractual cases, including international legal cooperation, protection of life or physical integrity, ANPD authorization, commitments in international cooperation agreements, execution of public policy or legal public-service attribution, specific and prominent consent for the transfer, and the Article 7(II), (V), and (VI) situations expressly incorporated by Article 33(IX). Apply the exact conditions rather than treating these as broad exceptions.
- : verify that the effective ANPD decision covers the destination, importer, data flow, purpose, and sector, and record any exclusion.
- ANPD clauses: execute the Annex II text between the exporter and importer, allocate the stated responsibilities, control onward transfers, and make required Portuguese information available to data subjects.
- Approved safeguards: obtain ANPD approval before relying on specific contractual clauses or group-wide ; an application or internal policy is not an approved mechanism.
- Other Article 33 cases: document the exact statutory paragraph, its facts and limits, and any consent, authorization, cooperation instrument, public-policy mandate, emergency, contract request, or legal-proceeding evidence.
- Reassess before adding a destination, remote-access country, importer, subprocessor, onward transfer, purpose, data category, or incompatible commercial term.
Primary LGPD source for the legal mechanisms that permit international transfers of personal data from Brazil.
ANPD regulation source for international transfer procedures, standard contractual clauses, and related transfer mechanisms under the LGPD.
ANPD source showing regulatory treatment of international transfers and standard contractual clauses under the LGPD.
ANPD's current transfer page identifies the mechanisms in force, the European adequacy recognition, and the status of approvals for equivalent clauses, specific clauses, and binding corporate rules.
The adequacy decision defines its European territorial and institutional scope, exclusions, effective date, continuous monitoring, and four-year reassessment period.