The Brazilian National Data Protection Authority (ANPD) has published Resolution No. 19/2024, which defines the rules for the international transfer of personal data.
4 key points of the new regulation:
1. What is international data transfer: It occurs when personal data is transferred, shared or made available to an agent located in another country.
2. When is it permitted: It can only occur if it is supported by one of the legal bases provided for in the Brazilian Data Protection Law (Articles 7 and 11) and one of the valid mechanisms for carrying out international transfers.
3. Transfer mechanisms: The resolution provides for 4 main mechanisms:
(i) Adequacy decision: ANPD must recognize the equivalence of the level of data protection of another country, thus enabling the international transfer of data.
(ii) Standard contractual clauses: The data transfer must be carried out under the terms of the standard clauses provided for in Annex II of the Resolution. These clauses must be incorporated within 12 months by the data controllers that use this mechanism to carry out transfers.
(iii) Specific contractual clauses: When the international transfer of data cannot be carried out through standard contractual clauses, the controller may request the ANPD’s approval of specific contractual clauses to carry out the transfer.
(iv) Binding Corporate Rules: Must be approved by the ANPD and are intended for international transfers of personal data between organizations of the same group or conglomerate of companies. They are binding on the members of the group that subscribe to them.
4. Impacts on companies:
(i) Need for adaptation: Companies that carry out international data transfers must assess whether their processes comply with the new resolution.
(ii) Transparency: The controller must publish on its website information about the international data transfer.
(iii) Choice of appropriate mechanism: The choice of transfer mechanism will depend on the characteristics of the operation and the relationship between the parties.
ANPD’s Resolution represents a significant advance in the protection of personal data in Brazil, establishing a more robust regulatory framework for international transfers. Companies operating in this market must be aware of the new requirements.
