Brazil's New Rules on International Data Transfers

In August 2024, Brazil’s National Data Protection Authority (ANPD) introduced new rules for international personal data transfer. These rules, called Resolution CD/ANPD No. 19/2024, are part of Brazil’s General Data Protection Law (LGPD) and aim to align Brazil with global privacy frameworks like Europe’s GDPR. The regulation explains how companies can legally transfer personal data from Brazil to other countries and sets requirements for compliance.

One key feature of the regulation is the mandatory use of Standard Contractual Clauses (SCCs) approved by the ANPD. These clauses must be included in contracts for cross-border transfers. Companies have until August 23, 2025 to comply. Other options include applying for approval of custom clauses, using Binding Corporate Rules (BCRs) for multinational groups, or relying on future adequacy decisions by ANPD—though none have been issued yet.

For U.S. companies that receive or process Brazilian personal data—especially in industries like cloud services, e-commerce, finance, and healthcare—these rules bring new legal and operational responsibilities. Businesses must update contracts, map how data moves across borders, assess security practices, and prepare to report data breaches within three business days. Companies also need to improve internal processes, appoint a Data Protection Officer (DPO), and ensure they follow the new rules.

While these changes require effort, they also offer opportunities. By complying early, U.S. companies can build trust with Brazilian clients and partners, avoid fines, and stand out in a market that values privacy. Showing a strong commitment to data protection can help U.S. businesses compete and grow in Brazil’s digital economy.

To get started, U.S. companies should review their current practices, update contracts to include SCCs, and strengthen their data protection systems. Appointing a DPO and working with legal or privacy experts can help ensure compliance. Acting quickly will help businesses avoid risks and take advantage of opportunities in Brazil’s growing market.

For additional information, please contact Digital Attaché Natalie Hatour at Natalie.Hatour@trade.gov and ICT Commercial Specialist Patricia Marega at Patricia.Marega@trade.gov.