Brazil LGPD International Transfer Mechanisms

Adequacy is available only for a country or international organisation covered by an ANPD decision and subject to that decision's conditions. Resolution 32/2026 covers all EU Member States, Iceland, Liechtenstein, Norway, and EU institutions, bodies, and agencies. It excludes transfers solely for public security, national defence, state security, or criminal investigation and enforcement. Confirm the actual destination, recipient, purpose, and onward flow.

ANPD standard contractual clauses are the usual contractual mechanism. Adopt Sections I-III of Annex II to Resolution 19/2024 integrally and without changing their text. Complete the permitted fields, choose the applicable options, and describe security measures. Other contract terms may not exclude, change, or contradict the clauses.

Specific contractual clauses are exceptional and need prior ANPD approval after the controller shows why the standard clauses are impracticable. Global corporate rules also need prior ANPD approval and must be tied to an Article 50 governance program. The ANPD's current transfer page states that it has not recognised equivalent foreign standard clauses and has not approved specific clauses or global corporate rules, so an application or foreign approval is not a usable mechanism by itself.

The controller verifies LGPD applicability, the processing basis, and the mechanism. Privacy or legal prepares the analysis; procurement or the business owner executes the contract; security documents and tests safeguards; operators provide facts and implement instructions.

For standard clauses, keep the signed instrument, completed exporter and importer identities and roles, transfer description, selected onward-transfer option, security schedule, additional clauses, and proof that additional terms do not contradict the ANPD text. For adequacy, retain the current decision and the facts showing the transfer is covered. For another Article 33 route, record every case-specific condition rather than naming the route alone.

Do not confuse EU adequacy, ANPD recognition of foreign standard clauses as equivalent, and use of ANPD standard clauses. They are distinct mechanisms with different evidence.

Specific consent must be informed, prominent, specific to the transfer, and clearly separate from other purposes. It may be unsuitable where refusal is not genuinely available or where another Article 33 route better describes a necessary, recurring transfer.

Use a mechanism register with status values such as adequate destination confirmed, ANPD clauses executed, specific clauses approved, global corporate rules approved, or another Article 33 route documented. Do not mark a mechanism complete while an approval application is pending.

The 12-month transition period in Resolution 19/2024 has ended. A contractual transfer that relies on clauses should now use the ANPD clauses unless another valid mechanism covers it.