Resolution CD/ANPD No. 19/2024 (“Resolution”) approved the International Data Transfer Regulation to establish the procedures and processing agents must observe to ensure the lawful international transfer of personal data.
Under the Resolution, international data transfers may occur only: (i) to countries or international organizations recognized by the National Data Protection Authority (ANPD) as providing an adequate level of personal data protection, equivalent to that established under Law No. 13,709/2018 (LGPD); or (ii) when the controller offers guarantees of compliance with the data protection regime provided for in the LGPD, including by the adoption of standard contractual clauses issued by the ANPD, which provides for minimum guarantees and safeguards for international data transfers.
The Resolution establishes August 23, 2025, as the deadline for processing agent that use contractual clauses to carry out international data transfers must incorporate the ANPD-approved standard compliance clauses into their existing agreements. After this period, processing agents that do not comply with the rules of the Resolution will be subject to the sanctions provided for under the LGPD.
For more information on the International Data Transfer Regulation and support in legal and contractual compliance, please contact Saud Advogados.