Does your company send information about customers, employees, or suppliers in Brazil to a parent company, a system, or a vendor in the United States? If so, it is making an international data transfer. Under Brazil’s General Data Protection Law (LGPD), that transfer needs a formal legal mechanism, and since August 2025, Brazil’s data protection authority can enforce it.
A stronger regulator in 2026
In February 2026, Law 15,352/2026 turned the ANPD into a regulatory agency, now called the National Data Protection Agency, with its own budget and decision-making autonomy. Penalties under the LGPD can reach 2% of a company’s revenue in Brazil, up to BRL 50 million per violation.
What counts as an international transfer
A transfer happens when personal data handled in Brazil is sent to a person or company in another country. Typical examples include a Brazilian subsidiary sharing its customer list with a U.S. parent company, an HR team using a platform hosted in the U.S., or a Brazilian business sending data to a software provider abroad.
The permitted mechanisms
Article 33 of the LGPD and ANPD Resolution 19/2024 set out the main routes:
- Adequacy decision: the ANPD recognizes that the destination country offers a level of protection equivalent to Brazil’s. In January 2026, the European Union received this recognition. The United States has not.
- Standard contractual clauses: a set of clauses drafted and approved by the ANPD, signed by the party sending and the party receiving the data.
- Specific contractual clauses: reserved for exceptional situations and subject to prior ANPD approval.
- Global corporate rules: internal rules for transfers within the same corporate group, also subject to ANPD approval.
Because the U.S. has no adequacy decision, standard contractual clauses are, in practice, the most common route for transfers from Brazil to the United States.
The clauses must be used as written
The ANPD’s standard clauses must be adopted in full, without any changes to their text. They may be inserted into a broader agreement or signed as a separate document, as long as the approved wording is kept. Companies that relied on their own clauses had until August 2025 to switch to the official model.
Transparency on your website
A company that transfers data out of Brazil must publish clear information about it on its website or in its privacy policy, including the purpose, how long the transfer lasts, the destination country, and the rights of the people whose data is involved. It must also provide the full text of the clauses to any individual who asks.
A checklist for your contracts
- Map every data flow that leaves Brazil and who receives it.
- Identify which legal mechanism supports each flow.
- Add the ANPD’s standard clauses, unchanged, to agreements with your parent company, group companies, and vendors.
- Update your privacy policy with the required transfer information.
- Keep signed contracts and records ready in case the ANPD requests them.
Grubbs Legal Consultant helps companies align their contracts and policies with the LGPD, in English and Portuguese. Contact us.
This article is for informational purposes only, addresses Brazilian law exclusively, and does not constitute legal advice. Luciene Grubbs is not admitted to practice law in Florida.