LGPD – Final Deadline for Contractual Compliance on International Data Transfers
Companies that engage in international data transfers of personal data have until August 23, 2025, to incorporate the standard contractual clauses into their agreements, as established by ANPD Resolution No. 19/2024.
What are the Standard Contractual Clauses?
Developed by the Brazilian National Data Protection Authority (ANPD), the standard contractual clauses ensure the protection of personal data transferred from Brazil to foreign jurisdictions. They establish minimum safeguards and valid conditions for conducting international data transfers in accordance with the LGPD, even when the destination country does not provide an adequate level of data protection.
The adoption of global corporate rules for intra-group international data transfers, subject to ANPD approval, constitutes a valid alternative to the use of standard contractual clauses.
What qualifies as an international data transfer?
An international data transfer occurs when personal data is transferred from a data-exporting entity to a data-importing entity located abroad. If the personal data was originally collected outside Brazil, the transfer is not considered international under the LGPD—even though the LGPD provisions may still apply.
Who must update their contracts?
- Multinational companies that share employee, customer, or partner data with foreign affiliates or headquarters.
- Organizations that use cloud storage services (e.g., AWS, Google Cloud) and transfer personal data to servers located outside Brazil.
- E-commerce platforms, marketplaces, and online service providers that work with foreign suppliers, partners, or payment gateways.
What are the legal bases for international transfers?
International data transfers must serve legitimate, specific, explicit, and informed purposes, and the subsequent processing of the data must not be incompatible with these purposes. Additionally, the transfer must be grounded in one of the legal bases set forth in Articles 7 or 11 of the LGPD, and must rely on a valid mechanism for international data transfer.
F/A Advogados is available to support your organization in interpreting and applying the LGPD’s data protection rules to your business, as well as in reviewing and adapting your contracts to ensure compliance with applicable legislation.
Back to Previous Page