Data controllers and processors in Brazil must update contracts by August 2025 to include the standard clauses for international personal data transfers under ANPD (Brazilian Data Protection Authority) Directive No. 19/2024. These transfers occur when an exporter in Brazil sends, shares, or provides access to personal data collected locally to an importer abroad, such as when using cloud services hosted internationally.

What does ANPD Directive No. 19/2024 cover?

It defines the mechanisms available for international personal data transfers, including standard contractual clauses, specific clauses, and Binding Corporate Rules (BCRs). It also sets criteria for recognizing countries and international organizations that provide adequate data protection – a matter the ANPD has yet to address.

To ensure legal certainty, the Directive establishes specific rules for two situations:

• When personal data is transferred to countries the ANPD deems to have adequate protection.
• When companies ensure compliance with the principles, rights, and protection framework set out in the Brazilian General Data Protection Law (LGPD).

What are the requirements for transferring personal data internationally?

Directive No. 19 outlines the mechanisms that allow these transfers:

• Binding Corporate Rules (BCRs) – the main route for multinational groups. BCRs must be part of a privacy governance framework that meets LGPD standards and should include:
  • a clear description of the transfers and types of personal data involved.
  • identification of the destination countries.
  • the group’s corporate structure and data protection responsibilities.
  • procedures for reviewing the BCRs and mandatory notification to ANPD of any changes or legal barriers affecting group companies.

These rules must be submitted to and approved by the ANPD by August 2025.

• Specific contractual clauses: used when standard clauses do not fit particular scenarios. They require ANPD review and approval by August 2025.
• Standard contractual clauses: minimum requirements issued by ANPD to be included in contracts involving data transfers.
• Transparency obligation: companies transferring personal data internationally must publish on their websites a clear and accessible notice in Portuguese that includes the specific purpose, duration, and method of the transfer, the destination country, and the name and contact details of the data controller.

Required steps for compliance:

• Map all international personal data transfers conducted.
• Identify the legal basis for each transfer (contract, adequacy decision, consent).
• Review or draft Binding Corporate Rules within corporate groups, or specific clauses for transfers with partners.
• Submit specific clauses or Binding Corporate Rules for ANPD approval, if required.