ANPD approves Regulation on International Data Transfer and Standard Contractual Clauses
On August 23, 2024, the National Data Protection Authority (ANPD) issued Resolution CD/ANPD No. 19/2024, which approves the International Data Transfer Regulation (“Regulation”) and the content of standard contractual clauses. We highlight below the main topics of the resolution:
Definition of International Data Transfers
The Regulation clarifies the distinction between:
- International Data Transfer – when a data processing agent located in Brazil or a foreign country (in either case defined as “exporter”) transfers personal data to a data processing agent located in a foreign country or international organization (in either case defined as “importer”); and
- International Data Collection – collection of personal data directly from the data subject by a data processing agent located abroad, which does not characterize an international transfer and must comply with the provisions of the Brazilian General Data Protection Law (LGPD), if it fits within any of the scenarios described in Article 3 of the LGPD.
Adequacy Decision as a Legal Basis for Transfer
The ANPD may recognize, through an adequacy decision, the equivalence of the level of personal data protection in a foreign country or international organization with Brazil’s data protection legislation, taking into account many factors, including: applicable laws; the nature of the data; adherence to general principles of data protection and rights of data subjects in the LGPD; adequate security measures to minimize impacts on civil liberties and fundamental rights; and existence of judicial and institutional safeguards for the protection of rights.
The resolution establishes the procedures for the ANPD to issue an adequacy decision and indicates that the ANPD will prioritize assessing the level of personal data protection in countries that ensure reciprocal treatment to Brazil and whose recognition of adequacy facilitates the expansion of the free flow of international transfers.
Standard Contractual Clauses as a Legal Basis for Transfer
The resolution contains a template of standard contractual clauses for use by data processing agents for international transfers.
For this purpose, the exporter and importer must incorporate the standard contractual clauses in full and without changes (except for editable fields) into the contractual instrument executed between them.
Data processing agents that use contractual clauses to carry out international data transfers must incorporate the standard contractual clauses into their contractual instruments within 12 months from the date of publication of the resolution.
Specific Contractual Clauses and Global Corporate Rules as Legal Bases for Transfer
In addition to standard clauses, the controller may request approval from the ANPD for specific contractual clauses, and organizations within the same group or conglomerate of companies may request approval from the ANPD for global corporate rules – in both cases, through the procedure set forth in the Regulation.
The Regulation does not exclude the other international data transfer mechanisms set forth in the LGPD.
The full wording of the resolution in Portuguese is available at https://www.in.gov.br/en/web/dou/-/resolucao-cd/anpd-n-19-de-23-de-agosto-de-2024-580095396.
For more information, please contact the leaders of our Privacy and Data Protection team, Adriano Chaves and Marcia Issler Mandelbaum.
This bulletin is for information purposes only and should not be relied upon to obtain legal advice on any of the topics dealt with here.
CGM Advogados. All rights reserved.