Brazil LGPD International Transfers

First identify the exporter, importer, controller and operators, countries, purposes, data, people, storage, remote access, and onward transfers. The exporter is the processing agent that sends, shares, or gives access to the data; the importer is the processing agent in a foreign country or international organisation that receives it. Confirm that the operation is an international transfer and that Brazilian data-protection law applies.

Then select an Article 33 mechanism. Common routes are an ANPD adequacy decision or the ANPD standard contractual clauses. Specific contractual clauses and global corporate rules require prior ANPD approval. Other Article 33 routes remain available only when their case-specific conditions are met.

Resolution 32/2026 covers all EU Member States, Iceland, Liechtenstein, Norway, and EU institutions, bodies, and agencies. It does not cover every European country and excludes transfers solely for public security, national defence, state security, or criminal investigation and enforcement. Confirm the actual destination, recipient, purpose, and onward transfer.

The controller must verify whether the operation is a transfer, whether the LGPD applies, and whether a valid processing basis and transfer mechanism support it. Operators must provide the information they hold and implement the controller's instructions.

Keep exporter and importer identity and roles, the transfer description, purposes, data, people, countries, retention, Article 7 or 11 basis, Article 33 mechanism, executed safeguard or adequacy decision, onward transfers, security measures, transparency, rights route, approvals, and review date. Record whether the flow is a direct transfer, access by another processing agent, onward transfer, or international collection because each description changes the mechanism analysis.

Do not use EU standard contractual clauses as a substitute for ANPD clauses unless the ANPD has formally recognised clauses as equivalent and the decision's conditions are met. The EU adequacy decision is a different mechanism from clause equivalence.

The foreign-origin exception is narrow. Confirm whether data merely transits Brazil without communication or shared use with a Brazilian processing agent, or returns only to its qualifying country of origin under the conditions in Resolution 19/2024. Reuse, sharing, or a different onward destination can change the result.

Use an intake that discovers both planned and existing transfers. Reject a generic vendor assurance: the approval must identify the actual importer, purposes, data, system, mechanism, contract or decision, security measures, onward-transfer path, and transparency control.

For ANPD clauses, the 12-month transition period from the publication of Resolution 19/2024 has ended. Existing contracts that rely on contractual clauses should now contain the ANPD clauses when that is the selected mechanism.