Brazil: Implemented General Data Protection Law (LGPD) including data transfer regulations

After an initial grace period, the Brazilian data protection law (Lei N° 13.709) is fully implemented and can be enforced by the Brazilian courts and responsible agencies, with the possibility to apply the penalties contained in the law. The Law unifies over 40 different statutes governing personal data protection and establishes the National Data Protection Authority as the main enforcer. Moreover, it is set out in Chapter V (Art. 33-36) that the transfer of personal data shall be made only to countries ensuring a level of data protection adequate to the law's standards.