BrazilLGPD, international transfer of data
Lei nº 13.709, de 2018 (LGPD), arts. 33-36 (international transfer of data)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Access restriction
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Transfer personal data outside Brazil only to a country or organization with an adequate level of protection, or under contractual clauses, corporate rules, or another article 33 safeguard.NIST Privacy FrameworkCT.PO-P2
- Where you rely on standard contractual clauses, specific contractual clauses, global corporate rules, or a certification seal for a transfer, use only a form the ANPD has verified or approved, and report any change to those safeguards to it.NIST Privacy FrameworkCT.PO-P2
- Get the data subject's specific, highlighted consent before an international transfer that does not rest on an adequacy finding or another article 33 safeguard, telling them in advance that the operation is international.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 33 to 36 set the conditions for transferring personal data abroad and give the national authority the task of checking standard contractual clauses, specific clauses, corporate rules, seals and certificates. Article 36 requires changes to the guarantees offered to be communicated to the authority, which is a notification and not a record the controller keeps. No cited article requires a log or a record.
- Kind
- None
- As of
What this law does
Article 33 permits international transfer of personal data only to a country or international organization offering an adequate level of data protection, where the controller proves compliance through specific or standard contractual clauses, global corporate rules, or a certification seal, for international legal cooperation among investigative or prosecutorial bodies, to protect life or physical safety, where the ANPD authorizes the transfer, under an international cooperation commitment, for a public-policy purpose given publicity, or with the data subject's specific, highlighted consent given after being told the operation is international.
Article 34 requires the ANPD to weigh the destination country's or organization's general and sectoral rules, the nature of the data, the LGPD's principles and rights, its security measures, and its judicial and institutional guarantees before finding its protection adequate.
Article 35 gives the ANPD authority to define standard contractual clauses and to verify specific clauses, global corporate rules, or certification seals, including through a certifying body it may designate and review, and article 36 requires any change to safeguards the ANPD accepted as sufficient to be reported to it.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .