The transition period established by Resolution CD/ANPD No. 19/2024 Resolution CD/ANPD No. 19/2024 for adopting the Standard Contractual Clauses (SCCs) approved by the ANPD, which regulate international data transfers, ends on August 23, 2025. Published in August 2024, the Resolution approved the Regulation on International Data Transfers and the content of these clauses—setting out the legal criteria and safeguards for transferring personal data from Brazil to other countries or international organizations, in accordance with Articles 33 and following of the LGPD.
After this date, the use of contractual clauses as a legal basis for international transfers will only be valid if the ANPD’s SCCs are adopted or if specific clauses have been approved by the Authority and provide an equivalent level of protection.
Organizations currently relying on their own contractual clauses or foreign templates—such as the European Union’s SCCs or clauses adapted from other jurisdictions—need to review and replace those with the ANPD’s SCCs, or formally seek approval or recognition of equivalence for specific clauses under the Regulation.
In addition to the standard clauses, the ANPD recognizes other valid mechanisms to legitimize international data transfers. These include:
- A formal adequacy decision by the Authority, confirming that a country or international organization offers a level of data protection compatible with the LGPD—although no such decision has been published to date;
- Binding Corporate Rules (BCRs), applicable to data transfers within multinational corporate groups, provided they are approved by the ANPD and supported by an appropriate data governance program;
- Specific contractual clauses when it is not possible to adopt the SCCs—subject to ANPD review and approval;
- Other legal bases established by the LGPD that do not require specific regulation, such as data subject consent, exercising rights in legal or administrative proceedings, or performing a contract with the data subject.
With the deadline for adopting the SCCs approaching, we recommend that organizations that have not yet started this process review their contracts and international data flows to identify the applicable transfer mechanism—and begin any necessary contract updates or submissions to the ANPD.
Our Data Protection team is available to support the implementation of these measures and to answer any questions on this or other related topics.
