International Affairs

Decisions issued by ANPD that recognize certain countries or international organizations as having a level of data protection equivalent to that required by Brazilian law. When an adequacy decision is issued, international data transfers to these countries or organizations can take place without the need for additional international transfer mechanisms.

These are contractual clauses predefined by ANPD, which can be incorporated into already existing contracts. They establish minimum safeguards so that, even in countries where the data protection regime is different from Brazil’s, personal data continues to be protected in accordance with the standards required by the LGPD. These clauses must be implemented without modification (Annex II of the Regulation), within 12 months of the publication of the Regulation (Art. 2, single paragraph).

These refer to standard contractual clauses approved by foreign countries or international bodies, which may be recognized by ANPD as equivalent to Brazilian standard contractual clauses. Once considered equivalent, and subject to any conditions established by ANPD, data processors and controllers may use these clauses in their international data transfers without the need to use the standard contractual clauses in Annex II of the Regulation.

They can be used in exceptional situations, where it is proven to be unfeasible to use standard contractual clauses. These clauses must offer an equivalent level of data protection to the one guaranteed by national standard contractual clauses and must be adapted to the particular circumstances of certain transfer operations. Prior approval by ANPD is required to validate the use of this mechanism.

Set of internal rules adopted by organizations in the same group or conglomerate of companies to regulate the international transfer of personal data between their different entities. These rules, which must be previously approved by ANPD, ensure that all companies in the group, regardless of the jurisdiction in which they operate, respect the level of data protection required by the LGPD. These standards are especially useful for companies that operate in several countries and wish to maintain a uniform approach to personal data protection in their international operations.

Initiated by decision of the Board of Directors (ex officio) or at the request of public entities (sole paragraph of art. 1 of Law no. 12.527, of November 18, 2011), the process is conducted by ANPD's technical area (CAI/CGRII), which analyzes the legal context, rules, security measures and institutional guarantees of the country or body in question. ANPD's Specialized Federal Prosecutor's Office issues an opinion on adequacy, and the Board of Directors decides on approval. If approved, the decision is formalized and published on ANPD’s website. Decisions can be revised or revoked according to changes in the conditions of the country or international body, ensuring continued compliance with the LGPD. To date, the European Union has been considered an adequate international body by ANPD's Board of Directors through the publication of Resolution No. 32/2026.

The process can be initiated by the Board of Directors (ex officio) or at the request of interested parties. ANPD's technical area (CGRII/CAI) carries out a detailed analysis of the compatibility of the foreign clauses with Brazilian standards and the LGPD. The Specialized Federal Attorney's Office at ANPD issues an opinion and the request is then submitted for final deliberation by the Board of Directors. ANPD can also consult with society or hear opinions from other public administration bodies with related competencies. If approved, the clauses will be recognized by a specific resolution and published on ANPD's website, becoming valid for international data transfers, if the conditions established by the Board's decision are observed. To date, no equivalent standard contractual clause has been recognized by ANPD's Board of Directors.

The controller must submit to ANPD the full text of the clauses it intends to use, proving that they offer and prove guarantees of compliance with the principles, the rights of the data subject and the data protection regime provided for by the LGPD. Its approval by the Board of Directors is necessary for the international transfer of data to take place based on this mechanism. The approval of specific clauses will only occur in exceptional situations, i.e. when, for reasons of fact or law duly proven by the interested party, it is unfeasible to use the standard contractual clauses. The process includes a detailed analysis of the proposed provisions by CAI/CGRII and the Specialized Federal Attorney's Office, considering compatibility with Brazilian legislation and the risks and benefits involved. To date, no specific contractual clauses have been approved by ANPD's Board of Directors.

They must be submitted to ANPD's approval, accompanied by a detailed description of the transfers they cover, the countries involved, and the security measures implemented. In addition, these rules must be linked to a privacy governance program that complies with the requirements of the LGPD (art. 50). After analysis by CAI/CGRII and the Specialized Federal Prosecutor's Office, the binding corporate rules will be subject to deliberation by the Board of Directors. To date, no binding corporate rules have been approved by ANPD's Board of Directors.

Resolution CD/ANPD No. 19/2024 is the International Data Transfer Regulation issued by ANPD that establishes the mechanisms for the international transfer of personal data in accordance with the LGPD. This Regulation provides for standard contractual clauses, equivalent standard contractual clauses, specific contractual clauses, binding corporate rules and adequacy decisions.

Specific contractual clauses can only be used if previously approved by ANPD. Such approval will only take place in exceptional situations, when, for reasons of fact or law duly proven by the interested party, it is impracticable to use the standard contractual clauses. These exceptional circumstances and the clauses must be submitted to ANPD for appraisal, accompanied by the relevant documentation, as provided for in the Regulation.

Requests for approval must be made through ANPD's Electronic Information System (SEI). The documentation required for the application is detailed in the Regulation and includes, among others, the full text of the proposed clauses or rules, as well as additional information proving compliance with the requirements of the LGPD.

ANPD will publish on its website a list of countries and international bodies that have been granted adequacy decisions by the Board of Directors. This list will be constantly updated, allowing controllers to check whether the international transfer of personal data to a particular country is covered by an adequacy decision. TTo date, the European Union has been deemed an adequate international body by ANPD's Board of Directors through the publication of Resolution No. 32/2026. For this, a specific procedure is required, as provided for in the Regulation. As other decisions like this are issued, this website will be updated to include a list of countries deemed adequate.

ANPD will publish on this website a list of the equivalent standard contractual clauses, specific clauses and binding corporate rules approved by the Board of Directors. As with the adequacy decisions, this list will be constantly updated. To date, none of these mechanisms have been approved by ANPD's Board of Directors. This requires a specific procedure, provided for in the Regulation.

Adequacy decisions issued by other countries are not valid for Brazil. However, the information and analysis contained in these decisions may be considered as a subsidy for the issuance of adequacy decisions by ANPD.

Processing agents who carry out international transfers of personal data must ensure that these operations comply with the LGPD and the International Data Transfer Regulation, adopting the mechanisms provided for by the standard and the safeguards appropriate to the case. Among other obligations, processing agents must guarantee the exercise of rights and provide clear information to data subjects about the transfer.

The Regulation specifies who is entitled to file a request for analysis by ANPD for each international data transfer mechanism. In the case of specific contractual clauses, it is the controller who requests analysis (art. 21), while for equivalent standard contractual clauses the request can be submitted by any interested party (art. 18). For binding corporate rules, the request can be submitted by organizations from the same group or conglomerate of companies (art. 25). Finally, the issuance of adequacy decisions (art. 13) can only be requested by public bodies or entities. It is worth mentioning that the procedures for issuing an adequacy decision (art. 13) or approving equivalent clauses (art. 18) may also be initiated ex officio by ANPD, by decision of the Board of Directors.