Brazil LGPD Transfer Workflow

First determine whether an exporter sends personal data to an importer in another country or international organization. Resolution 19 distinguishes a transfer from international collection: direct collection from a person by an agent abroad is not itself a transfer, although the LGPD may still apply under Article 3.

For an in-scope transfer, the controller must verify three separate points: the transfer is subject to Brazilian data-protection law, the underlying processing has a valid Article 7 or 11 legal basis, and one Article 33 transfer mechanism applies. A contract cannot cure a missing processing legal basis, and a processing legal basis alone does not authorize the international transfer.

Apply the test to the actual path, not the vendor's headquarters. Record where the exporter and importer act, where personal data become available, whether an overseas recipient receives them, and whether later disclosures create onward transfers. Mere transit through another country should not be treated as a completed mechanism analysis without checking the facts and Resolution 19's definitions.

Use an ANPD adequacy decision only for the country or international organization and scope stated in that decision. As of 24 July 2026, the ANPD repository identifies the European Union as adequate under Resolution 32/2026. A foreign authority's adequacy decision does not automatically work in Brazil.

If there is no applicable adequacy decision or other Article 33 mechanism, the ANPD standard contractual clauses in Annex II are the usual contractual route and must be adopted without changes to their mandatory text. The 12-month transition from Resolution 19's August 2024 publication has expired; existing transfers relying on contractual clauses should already have been updated. Specific contractual clauses and binding corporate rules require prior ANPD approval, and the current ANPD repository reports no approvals for those mechanisms or for equivalent foreign standard clauses.

The other Article 33 routes are fact-specific, not fallback labels. The cooperation-agreement route applies when the transfer results from a commitment made in an international cooperation agreement, the protection-of-life route applies when the transfer is necessary to protect the life or physical safety of the data subject or a third party, ANPD authorization requires an authority act, and specific consent must be separate, highlighted, and informed about the international nature of the operation. Record the precise paragraph and every condition used.

Approve the transfer only when the data map, legal basis, mechanism, contract or decision, security measures, rights route, incident cooperation, retention, and onward transfers agree. The controller remains responsible for verifying the transfer, and the operator must provide information needed for that verification.

Give data subjects clear, accessible information about the transfer, including its purpose, duration, destination, responsibilities, and rights as required by Resolution 19. Reassess after a new importer, sub-operator, country, purpose, data category, onward transfer, legal change, ANPD decision, security incident, or material control change.