On August 23, 2024, the Brazilian National Data Protection Authority (“ANPD” or “Brazilian DPA”) published Resolution CD/ANPD no. 19 (“Regulation”), setting out the rules for the international transfer of personal data under the Brazilian General Data Protection Law (“LGPD”). The Regulation was the subject of a public consultation in 2023, which we analyze in this newsletter, and its publication was widely anticipated.
The Regulation established details and procedures regarding the issuance of adequacy decisions for the foreign country or organization by the ANPD, as well as regarding the contractual mechanisms that can be used for international transfers, such as specific contractual clauses, standard contractual clauses (“SCCs”), and binding corporate rules (“BCR”).
The SCCs were established by the Regulation, with their text attached to the norm, and must be fully adopted without any changes on their text. Moreover, the ANPD may recognize in the future other countries or organizations’ SCCs as equivalent to those provided in the Regulation, allowing these other SCCs to be used as alternatives.
Furthermore, the Regulation determined that information on the international transfer of data must be included on the controller’s website, either in its Privacy Policy, or in a separate document, detailing aspects such as the destination countries, the form, duration, and purpose of the transfer.
In addition, the Regulation also provided that the controller may use specific contractual clauses when the SCCs cannot be applied. On the other hand, BCRs can also be used, but only when the transfer occurs between companies within the same economic group. It is important to note that both specific contractual clauses and BCRs must be submitted for prior approval by the ANPD.
At last, controllers and processors who currently use contractual clauses to transfer data internationally will have a period of 12 months to include the SCCs established in the Regulation in their agreements.
Our team is at your disposal for further clarifications and to assist with complying with LGPD and ANPD regulatory requirements.
Gustavo Flausino Coelho – gustavo@bastilhocoelho.com.br
Fernando Naegele – fernando@bastilhocoelho.com.br