International Data Transfers Under the LGPD

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Transferring personal data abroad requires strict compliance with the LGPD, and companies that ignore this requirement face severe penalties and significant reputational risk.

What an international data transfer means under the LGPD

Brazil’s General Data Protection Law (Law 13.709/2018) pays special attention to the cross-border flow of personal information. Chapter V of the statute sets out an exhaustive list of circumstances in which personal data may be sent to other countries or international organizations. This concern is not unique to Brazil: regulations such as the European GDPR follow a similar logic, recognizing that the protection owed to the data subject cannot end at national borders.

In practice, an international transfer occurs whenever personal data is sent to, accessed from, or stored on servers located outside Brazil. That includes everyday situations such as using cloud computing platforms with data centers abroad, sharing information among branches of multinational groups, hiring foreign technology vendors, and even sending corporate e-mails through services hosted in other countries. Because the concept is so broad, organizations need to map carefully every data flow that crosses national borders.

Many Brazilian companies underestimate how far these operations reach. A simple CRM system hosted in the United States, a data analytics tool that processes information in Europe, or a cloud backup service that replicates data across multiple jurisdictions each counts as an international transfer under the LGPD. That is why the first step in any compliance program is to determine precisely where the personal data under the organization’s responsibility is actually being processed.

Legal grounds that authorize a transfer

Article 33 of the LGPD lists the situations in which international transfers of personal data are permitted. The first applies to countries or international organizations that provide a level of personal data protection adequate to that required by Brazilian law. The ANPD (Brazil’s National Data Protection Authority) is the body responsible for assessing that level of adequacy. It considers factors such as whether the country has specific legislation, whether an independent supervisory authority exists, and what international commitments the receiving country has undertaken.

Another important ground is the controller’s provision of guarantees of compliance. These guarantees can take several forms: specific contractual clauses, standard contractual clauses, global corporate rules (binding corporate rules), regularly issued seals or certificates, and codes of conduct. In our experience, specific contractual clauses are the mechanism Brazilian companies use most, because they allow the parties to the transfer to negotiate directly.

The LGPD also authorizes a transfer when the data subject has given specific, prominent consent for that purpose, after being told in advance that the operation is international and which countries are involved. It is worth stressing that this consent must be truly informed: the data subject must understand which country will receive the data, why it is being transferred, and what risks are involved. Generic consent buried in lengthy, hard-to-follow terms of use does not meet the legal requirement.

Due diligence in international data transfers is not a one-time exercise. It is an ongoing process that lasts for the entire life of the relationship with foreign partners and vendors.

Beyond these grounds, the law provides for exceptional situations, such as international legal cooperation between public bodies, protection of the life or physical safety of the data subject or a third party, execution of a public policy, and compliance with a legal or regulatory obligation. Each ground has its own requirements, which must be strictly observed for the transfer to be considered lawful.

Due diligence: essential steps before the transfer

When we conduct due diligence on an international data transfer, we break the process into stages that allow a comprehensive assessment of the risks involved. The first stage is a complete mapping of the data flows. We identify which categories of personal data will be transferred, who the affected data subjects are, the estimated volume of the transfer, its specific purpose, and the legal basis that supports the original processing of the data.

In the second stage, we evaluate the regulatory environment of the destination country. We check whether the country has data protection legislation equivalent to Brazil’s, whether an independent supervisory authority exists, whether there is a record of relevant administrative or court decisions on the subject, and whether the country is a party to international treaties that favor the protection of personal data. This analysis is critical because the ANPD may, at any time, question the adequacy of the receiving country.

The third stage involves evaluating the foreign partner or vendor. We review its privacy and information security policies, its technical and organizational controls, its history of security incidents, its certifications (such as ISO 27001 and SOC 2), and its ability to honor data subjects’ rights as the LGPD requires. This review is particularly important when the partner will act as a data processor, because the Brazilian controller remains responsible to the data subjects and to the ANPD.

The fourth stage concerns drafting the appropriate contractual instruments. Data protection clauses must be specific and detailed. They should address the purpose of the transfer, the categories of data involved, the required security measures, incident notification procedures, audit rights, conditions for onward transfers, and dispute resolution mechanisms. We recommend reviewing these instruments periodically to reflect any regulatory or operational changes.

Risks and consequences of noncompliance

The consequences of an international data transfer carried out in violation of the LGPD can be severe. On the administrative side, the ANPD has authority to impose sanctions ranging from warnings to fines of up to 2% of the legal entity’s revenue, capped at R$ 50 milhões per violation. In addition to fines, the authority may order the blocking or deletion of the personal data involved in the violation and the partial or total suspension of the operation of the database.

The risks go well beyond administrative sanctions. Exposure of personal data resulting from an improper transfer can give rise to civil liability, including an obligation to compensate data subjects for property damage and pain and suffering (danos morais). Depending on the number of data subjects affected, these claims can become very large, especially when brought as class actions.

The reputational impact also deserves attention. Companies that suffer incidents involving international data transfers often lose the trust of customers, business partners, and investors. In highly regulated sectors (such as finance and health care), that loss of trust can jeopardize strategic business relationships and make it harder to win new business.

There is also operational risk. An ANPD order to suspend international data flows can bring entire operations to a halt at companies that depend on technology infrastructure abroad. This prospect underscores the importance of building LGPD compliance into any project involving cross-border processing of personal data from the very start.

Best practices for a secure international transfer

Drawing on our experience in compliance projects, we have put together a set of best practices that we consider essential for organizations that carry out, or plan to carry out, international data transfers. First, we recommend preparing a Data Protection Impact Assessment (known in Brazil as the RIPD) specific to each significant international transfer flow. This document should describe the processing activities, assess the necessity and proportionality of the transfer, and identify measures to mitigate risks to data subjects.

Second, we suggest adopting technical measures that complement the legal safeguards. Encrypting data in transit and at rest, pseudonymizing data where feasible, applying granular access controls, and continuously monitoring for suspicious activity all significantly reduce the risks associated with international transfers. These technical measures should be proportionate to the sensitivity of the data transferred and the criticality of the operation.

Another key point is to establish a data governance program that includes periodic reviews of international transfer flows. We recommend conducting these reviews at least once a year, or whenever there are significant changes in the regulatory environment of the countries involved, in the foreign partner’s structure, or in the systems used for the transfer. Documenting these reviews is essential to demonstrate compliance to the ANPD.

Finally, we emphasize the importance of training the teams involved. Employees who handle personal data in international contexts need to understand the legal implications of their work, the internal procedures that apply, and the channels for reporting incidents or raising questions. Ultimately, an organizational culture built around data protection is the best guarantee of sustainable compliance.

This topic is directly related to the LGPD and civil liability, which we cover in a dedicated article.

This topic is directly related to sensitive data under the LGPD, which we cover in a dedicated article.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.