Brazil: National Data Protection Authority regulation on cross-border personal data transfers and standard contractual clauses (CD/ANPD No. 19) was fully implemented

On 23 August 2025, the transitional period established under Resolution CD/National Data Protection Authority (ANPD) No. 19 expired, requiring all data processing agents relying on contractual clauses for international transfers to have incorporated the ANPD-approved standard contractual clauses into their contractual instruments. From this date, compliance with the standard contractual clauses became mandatory, in addition to the immediate obligations already in force since 23 August 2024 concerning adequacy decisions, transparency measures, security incident notification, and the general requirements for cross-border personal data transfers.