Regulation of New Technologies
International data transfers under the LGPD: standard contractual clauses
Guilherme Chambarelli
Published on
3 min read
In this article
International data transfers from Brazil are allowed only through one of the mechanisms in Article 33 of the LGPD. For most companies, the practical tool is the ANPD’s standard contractual clauses (SCCs), approved by Resolution CD/ANPD No. 19/2024, which must be adopted in full. Since January 2026, transfers to the European Union can also rely on a mutual adequacy decision between Brazil and the EU.
Key points
- Every transfer of personal data abroad needs a legal mechanism under Article 33 of the LGPD.
- The ANPD SCCs must be incorporated without material changes.
- Brazil and the EU announced mutual adequacy in January 2026 (Resolution CD/ANPD No. 32/2026 on the Brazilian side).
- Transfers to other countries still need SCCs or another valid mechanism.
- A transfer mechanism does not replace a legal basis for the processing itself.
What counts as an international transfer?
Under the ANPD regulation, an international transfer occurs when an exporter in Brazil (or subject to the LGPD) makes personal data available to an importer located in another country. Typical examples are a Brazilian subsidiary sending HR data to its parent, a company using a cloud provider with servers abroad, or an outsourced support center outside Brazil accessing customer data. Data collected directly from individuals by a foreign company is a different situation: the LGPD may apply to that company, but the collection itself is not a transfer.
Which mechanisms are available?
| Mechanism | When it is used |
|---|---|
| Adequacy decision | Destination recognized by the ANPD as offering an adequate level of protection, such as the EU since 2026 |
| Standard contractual clauses | The default choice for intercompany and vendor transfers |
| Specific contractual clauses | When SCCs do not fit; require prior ANPD approval |
| Global corporate rules | Groups with a uniform internal policy; require ANPD approval |
| Other Article 33 hypotheses | Specific consent, contract performance, regular exercise of rights and other limited cases |
How do the ANPD standard contractual clauses work?
The SCCs are an annex to Resolution 19/2024 and must be adopted in their entirety. Companies may add them to an existing agreement or sign them as a standalone document, and may include additional commercial terms, provided these do not contradict the clauses. The regulation gave companies twelve months from its publication in August 2024 to bring existing contracts in line, a period that has already ended.
Key features include allocation of responsibilities between exporter and importer, rules on onward transfers, security obligations, data subject rights and cooperation with the ANPD. Exporters must also be transparent with data subjects about the transfer and provide information on the clauses when requested.
What changed with the EU adequacy decision?
In January 2026, Brazil and the European Union announced mutual adequacy decisions. On the Brazilian side, Resolution CD/ANPD No. 32/2026 recognizes the EU as offering adequate protection, with exclusions for transfers made solely for public security, national defense and criminal investigation. In practice, transfers from Brazil to the EU can rely on adequacy instead of SCCs. Companies should still review existing contracts, since adequacy does not eliminate other LGPD duties such as security, transparency and processor agreements.
Practical checklist
- Map every flow of personal data leaving Brazil, including cloud, support and analytics vendors.
- Identify the destination country and whether an adequacy decision covers it.
- For other destinations, adopt the ANPD SCCs without changes.
- Check that each processing activity also has a legal basis under Articles 7 or 11 of the LGPD.
- Update the privacy notice to describe international transfers.
- Keep records that show which mechanism supports each transfer.
Frequently asked questions
Can we keep using the EU SCCs for transfers from Brazil?
Not as a substitute for the Brazilian clauses. The regulation provides a procedure for the ANPD to recognize other countries’ clauses as equivalent, but absent such recognition, the ANPD SCCs apply.
Does adequacy cover transfers to the United States?
No. The adequacy decision announced in 2026 concerns the European Union. Transfers to other countries need another mechanism.
What are the penalties for an unlawful transfer?
The general LGPD sanctions apply, including fines of up to 2% of revenue in Brazil, capped at BRL 50 million per infraction.
How Chambarelli Advogados can help
Our Regulation of New Technologies team and our Foreign Desk map data flows, implement the ANPD clauses and align intercompany agreements. Book a meeting with one of our partners.
Informational content, updated October 2026. It does not replace advice on your specific case.
