Brazil: National Data Protection Authority regulation on cross-border personal data transfers and standard contractual clauses (CD/ANPD No. 19) entered into force, with a 12-month grace period for contractual clauses

On 23 August 2024, the Brazilian National Data Protection Authority (ANPD) published Resolution CD/ANPD No. 19, which approved and implemented the International Data Transfer Regulation and the standard contractual clauses. A transitional provision applies to international transfers based on contractual clauses: data processing agents must incorporate the ANPD-approved standard contractual clauses into their contractual instruments within twelve months of publication, with the deadline falling on 23 August 2025. All other provisions of the Regulation entered into force immediately on the date of publication. The Regulation establishes mechanisms for the cross-border transfer of personal data to foreign countries or international organisations where Brazil holds membership, and sets out the process for adoption of adequacy decisions. It further provides for ANPD-approved standard contractual clauses, the possibility for the ANPD to recognise the equivalence of standard contractual clauses from other jurisdictions, and the procedure for approving specific contractual clauses upon request of a controller. The Regulation also defines the minimum standards that global corporate standards must meet to be used as a transfer mechanism and describes the procedure for their authorisation. In addition, it sets out definitions, general requirements, transparency measures, and obligations applicable to controllers and processors.