Brazil. Data localisation / cross-border. Regulation
ANPD Res. 19/2024Resolution CD/ANPD No. 19/2024 - Regulation on International Data Transfers and Standard Contractual Clauses
In force
§1Summary
- Synopsis
Sets out procedures for international transfers under the LGPD, adopts mandatory ANPD standard contractual clauses and governs approval of specific clauses, BCRs and adequacy decisions.
- Key themes
- Unique features
ANPD SCCs must be adopted verbatim (no modification) and the controller must publish transfer information on request; foreign SCCs may be recognised as equivalent.
- SaaS relevance
SaaS providers receiving data from Brazilian customers outside Brazil generally need ANPD SCCs in their DPAs (or reliance on EU adequacy where applicable).
§2Obligations
- Extraterritorial
- Yes
- Cross-border transfers
- ANPD SCCs mandatory text since 2025-08-23
- Maximum penalty
- As per LGPD
§3Dates
- Key dates
- Adopted
- In force
- 12-month window to incorporate ANPD SCCs into existing contracts ended 2025-08-23
§4Text and authority
- Text
- Authoritative text in.gov.br
- Authority
- Agência Nacional de Proteção de Dados (ANPD)
§5Where it applies
- Domestic law of
- Brazil
§6Sources and verification
- Verification
High confidence.
DOU URL pattern from general knowledge.