International data transfers: the map after ANPD's regulation
Standard contractual clauses, adequate countries and specific safeguards — a practical guide to cross-border personal data flows under the LGPD.
Companies operating globally move personal data across jurisdictions every day. With Brazil’s data protection authority (ANPD) now regulating the matter, the topic has moved out of the grey zone and requires formal instruments.
The available mechanisms
The LGPD sets out specific grounds for international transfers — among them countries with an adequate level of protection, standard contractual clauses, binding corporate rules and specific safeguards negotiated case by case.
Standard clauses in practice
The standard clauses approved by the authority become the most common route for most companies. Adopting them, however, is not a mere formality: it requires assessing the transfer context and, often, supplementary security measures.
Recommendations
Map every international flow, identify the transfer basis applicable to each, and review contracts with processors and sub-processors. Consistent documentation is what sustains compliance when the authority comes knocking.