LGPD International Transfers: Resolution 19/2024 Rules

Transferring personal data to a foreign country or an international organization, including intra-group flows (Brazilian subsidiary to US parent), cloud hosting outside Brazil, and vendor access from abroad. Resolution 19/2024 clarifies that mere transit or the collection of data directly from the data subject by a foreign controller (a Brazilian consumer buying from a US website) is treated differently from a Brazil-side exporter handing data over. The exporter analysis, who is transferring to whom, on which instrument, is the first documented step.

The SCCs are annexed to Resolution 19/2024 and must be incorporated without material modification, additions are permitted only if they do not conflict. They cover controller-to-controller and controller-to-processor scenarios in a single set (unlike the EU's modular four). Signing them requires no ANPD approval or filing; they operate automatically once executed. Existing contracts had a 12-month adaptation window, until August 22, 2025, to incorporate them, so any legacy vendor contract still relying on EU SCCs alone for the Brazil leg is now out of compliance.

Not by themselves. The Resolution created a pathway for the ANPD to recognize 'equivalent' standard clauses from other jurisdictions or international organizations, on request and after analysis, but until the ANPD grants recognition to a specific set, EU SCCs are just a foreign contract. Multinationals therefore run dual paper: EU SCCs for GDPR legs, Brazilian SCCs for LGPD legs, often in one master agreement with two annexes. The same logic applies to frameworks like the EU-US DPF: helpful evidence, not a Brazilian mechanism.

The Brazilian analogue of Binding Corporate Rules: group-wide binding policies approved by the ANPD that authorize intra-group transfers without per-contract clauses. Resolution 19/2024 sets the content requirements, binding effect on all group members, enforceable data subject rights, training, audit, and a compliance structure, and the approval procedure. As with BCRs, expect a long approval runway; they suit large groups with heavy intra-group flows, while the SCCs remain the default for everyone else.

The ANPD can declare countries or organizations adequate based on their legal regime; it has been analyzing candidates (the EU/EEA being the obvious first tier) but companies should not build on anticipated adequacy. Absent adequacy or instruments, Article 33 allows transfers on specific and highlighted consent (informed of the international character in advance), or necessity grounds: legal obligation, contract execution, judicial proceedings, life protection, and public-policy execution. Consent works for one-off situations; it is fragile for recurring operational flows because revocation strands the pipeline.