Last review date: 3 January 2025

Yes.

Any country that is not Brazil.

Transfers of personal data to third countries are only permissible if there is a legal basis for the processing/transfer and one of the following applies:

☒       approved adequate/whitelisted jurisdictions
☒       to holders of specific certifications or followers of specific code of conduct programs each approved by the relevant data protection and cybersecurity authority (e.g., EU-US Data Privacy Framework)
☒       approved standard contractual clauses
☒       binding corporate rules
☒       derogations, such as consent, contract performance, necessity to establish, exercise or defend legal claims
☒       other solutions

Please see separate question for information on data localization provisions that are not restricted to personal data.

As per Article 33 of the LGPD, other transfer mechanisms available include:

• When the transfer is necessary for international legal cooperation between public intelligence agencies, public investigation agencies and public prosecution agencies, in accordance with international law mechanisms
• When the transfer is necessary for the protection of the life or physical safety of the data subject or a third party
• When the ANPD authorizes a specific transfer
• When the transfer is a product of a commitment undertaken under international cooperation

On 23 August 2024, the ANPD published the Regulation on International Data Transfer, which creates the procedures and rules for international transfers of personal data from Brazil to other countries. Companies have a 12-month deadline to ensure their transfers meet the requirements of the regulation (the deadline is in August 2025). Accordingly, the regulation sets out, among other aspects, the content of the standard contractual clauses as approved by the ANPD, and the manner by which data processing agents can otherwise ensure they have an adequate mechanism for international data transfers.