On Friday, August 23, 2024, the National Data Protection Authority ("ANPD") published Resolution No. 19/2024 ("Resolution"), which regulates aspects of the international transfer of personal data. This highly anticipated regulatory update details the requirements, mechanisms, and guidelines for transferring personal data to other countries, ensuring greater legal certainty for operations involving cross-border data flow, complementing the provisions of the General Data Protection Law ("LGPD").

The Resolution regulates aspects such as definitions and requirements for a particular transfer of personal data to fall under the norm, its legal bases, and transfer mechanisms in different scenarios, as well as the practical functioning of data flows. The regulation also defines exceptions for the transit and return of data to the country of origin.

The ANPD has established that it may recognize, through an adequacy decision, that the level of personal data protection in a foreign country or international organization is equivalent to that of national legislation. This could waive some procedural rules and facilitate the flow of international transfers. As of now, the list of countries offering an equivalent level of security has not been published.

Furthermore, following the same pattern adopted by the European Union, the resolution also addresses the standard contractual clauses that must be adopted in cases of transfer to countries not on the list of safe countries and that do not meet other requirements. These clauses, among other aspects, aim to ensure the commitment of the parties involved to comply with the LGPD, ensuring privacy and transparency. Data agents must incorporate the standard clauses within 12 months from the publication of the Resolution.

Finally, for international transfers of personal data between companies within the same group or conglomerate, the Resolution stipulates that the companies must create and submit their own set of rules and methods to ANPD for approval, to ensure the protection of personal data during the transfer. This includes identifying destination countries, defining the responsibilities of each involved company, guaranteeing the rights of data subjects, and implementing a privacy governance program, which will be binding for the group members adopting it.

The Resolution is a crucial milestone for personal data protection in Brazil, adapting to the growing digitalization and globalization. By establishing clear rules for international data transfer, the regulation offers greater legal certainty and ensures that personal data is handled properly, even when shared on an international scale.

We will continue to monitor ANPD publications and hope to bring further updates on the evolution of data protection regulations in Brazil soon.