BrazilANPD International Data Transfer Regulation (Resolution CD/ANPD No. 19/2024)
Resolução CD/ANPD nº 19 de 23 de agosto de 2024 (Regulamento de Transferência Internacional de Dados), Anexo I, arts. 4º, 9º, 16, 17, 21 and 28
In force since .
A cross border transfer rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting, User location, Place of effect
- Obligation class
- Transfer, Disclosure, Data subject rights
- Audit expectation
- none
What it requires
- Base every international transfer of personal data on a legal basis in article 7 or 11 of the LGPD and on a valid transfer mechanism: an ANPD adequacy decision, standard contractual clauses, global corporate rules, specific contractual clauses, or the hypotheses in article 33, items II(d) and III to IX, of the LGPD.
- Limit the transfer to the minimum necessary for its purposes, covering only data that are pertinent, proportionate and not excessive.
- Check whether the processing is an international transfer, whether it falls under Brazilian data protection law, and whether it rests on a valid legal basis and transfer mechanism, and adopt measures able to show compliance and their effectiveness.
- When you rely on the ANPD's standard contractual clauses, adopt the text of Annex II in full and without alteration in a contract between exporter and importer, and let no other term of the contract exclude, modify or contradict the clauses.
- Give a data subject who asks the full text of the clauses used for the transfer within 15 days, unless specific ANPD regulation sets another period and subject to trade and industrial secrecy, and publish on your website a plain-language document in Portuguese about the transfer.
- Submit specific contractual clauses and global corporate rules to the ANPD for approval before relying on them, and obtain its prior approval for any later change to them.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Article 4, paragraph 2 requires the controller and the operator to adopt measures able to show compliance with the data protection rules and the effectiveness of those measures; the Regulation names no log or record.
- Kind
- Implicit
- As of
- Provision
- Resolução CD/ANPD nº 19/2024, Anexo I, art. 4º, § 2º
- Trigger
- personal_data_processing
What this law does
Article 9 allows an international transfer of personal data only for legitimate, specific, explicit purposes informed to the data subject, resting on a legal basis under article 7 or 11 of the LGPD and on a valid transfer mechanism. The valid mechanisms are an ANPD adequacy decision, standard contractual clauses, global corporate rules, specific contractual clauses, or the hypotheses in article 33, items II(d) and III to IX, of the LGPD.
Article 16 makes a transfer on standard contractual clauses valid only if the exporter and importer adopt the text of Annex II in full and without alteration. Article 17 requires the controller to give a data subject, on request, the full text of the clauses used for the transfer, within 15 days unless specific ANPD regulation sets another period. Article 17, paragraph 2 also requires the controller to publish on its website a plain-language document in Portuguese about the transfer.
The ANPD approves specific contractual clauses only when standard clauses cannot be used because of exceptional circumstances of fact or law that the controller proves. Article 28 requires global corporate rules to be submitted to the ANPD for approval. Article 6 provides that an international collection of data is not an international transfer.
Parties that use contractual clauses for international transfers had to incorporate the ANPD's standard clauses into their contracts within 12 months of the Resolution's publication.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .