Resolution CD/ANPD No. 19, dated August 23, 2024, published by Brazilian National Data Protection Authority (ANPD) approved the Regulation on International Data Transfer and the content of standard contractual clauses, in accordance with Law No. 13.709, of August 14, 2018 (LGPD – Brazilian data protection law).
The Resolution comes into force on the date of its publication and establishes a period of up to 12 (twelve) months for data processing agents who use contractual clauses for international data transfers to incorporate the standard contractual clauses approved by ANPD into their respective contractual instruments.
The Regulation aims to establish procedures and rules applicable to international data transfer operations, which occur when the exporter, a data processing agent located in the national territory or in a foreign country, transfers personal data to the importer, a data processing agent located in a foreign country or international organization.
The international transfer of personal data, except in specific cases under the LGPD, will be allowed to countries or international organizations that provide an adequate standard of protection for personal data, as recognized by the ANPD, or if the controller offers and provides assurances of compliance with the principles of the LGPD, the rights of the data subject and the data protection framework, by means of specific contractual clauses, standard contractual clauses and global corporate rules.
In this context, it will be the role of the data controller to first verify whether the operation involves an international transfer of data and if the processing is supported by one of the legal bases, as well as if it is supported by valid international transfer mechanisms, as established in accordance with the terms of the LGPD and the Regulation.
The application of the rules of the LGPD and the Regulation to cases of international transfer of personal data will occur when, in national territory, there is the processing of data, the offer or supply of services or goods, the collecting of personal data, or the processing of data from individuals who are in the country.
International transfers of personal data are present in many processing operations, given the global context of data exchange in the digital space, from one country to another, which is fundamental for business success, innovation, economic growth and cooperation amongst countries.
The Regulation is binding and for this reason it directly impacts several companies in different sectors when it comes to processing personal data. Therefore, compliance and governance measures must immediately ensure that international data transfers are compliant with the new ANPD rules and guidelines.
Access the link directly to read the full ANPD Resolution on international data transfer: https://www.in.gov.br/en/web/dou/-/resolucao-cd/anpd-n-19-de-23-de-agosto-de-2024-580095396.
Di Blasi, Parente & Associados can help your organization fully understand the new rules and guidelines of the ANPD’s new Regulation. For more information, contact us at: consulting@diblasi.com.br.
