Brazil: Implemented regulation of cross-border personal data transfers and standard contractual clauses

On 23 August 2023, the Brazilian Data Protection Authority (ANPD) published Resolution CD/ANPD No. 19 of August 23, 2024 approving and implementing the data transfer regulation and standard contractual clauses. The regulation establishes mechanisms for the cross-border transfer of personal data to foreign nations or international organisations where Brazil holds membership. The regulation outlines the process of adequacy decision adoption and the ANPD-approved standard contractual clauses. Further, under the draft regulation, the ANPD can recognise the equivalence of standard contractual clauses from other countries and approve specific contractual clauses upon controller request. The regulation also includes the minimum standards that the global corporate rules have to meet to be used for transfers and the procedure for authorising them. In addition, the regulation provides definitions and general requirements.