ANPD international transfer regulation and standard clauses

In forceANPD Res. 19/2024 (transfers)

Summary

It regulates data transfers out of Brazil and approves standard contractual clauses, which had to be added to contracts by August 23, 2025. Since January 2026 the European Union is an adequate destination.

Who it applies to

Organizations that transfer personal data out of Brazil, for example to cloud AI vendors.

Penalties

Those under the LGPD (art. 52).

Official name: Resolução CD/ANPD nº 19, de 23 de agosto de 2024 – Regulamento de Transferência Internacional de Dados e conteúdo das cláusulas-padrão contratuais
Official reference: Resolução CD/ANPD nº 19/2024, DOU 23-ago-2024 (rectificada 18-ago-2025); complementada por la Res. CD/ANPD 32/2026 (adecuación de la UE)
Regulator: National Data Protection Authority (ANPD)
Official source: Check the sourceHow we verify sources

Key dates

August 23, 2024Published
August 23, 2025Deadline to adopt standard clauses
January 26, 2026EU recognized as adequate (Res. 32/2026)

Obligations and dates

Obligations table
Obligation	Article or citation	Status	Date	Who it applies to	Verification
Valid mechanism for each international transfer	LGPD, art. 33; Res. CD/ANPD 19/2024, arts. 1, 2 y 9	In force	Already applicable	If you send personal data outside Brazil, such as to AI services hosted in other countries.	Verified in the official source on November 2, 2026

Valid mechanism for each international transfer

LGPD, art. 33; Res. CD/ANPD 19/2024, arts. 1, 2 y 9In force

Already applicable

When it relates: If you send personal data outside Brazil, such as to AI services hosted in other countries.
What the rule provides: Use a valid mechanism: adequate country (for example, the EU), ANPD standard clauses, global corporate rules or approved specific clauses.
Add the ANPD standard clauses to contracts (deadline passed on Aug 23, 2025).
Also have a legal basis under LGPD arts. 7 or 11.
Typical evidence: Contracts with standard clauses.
Transfer map.
Related base documents: International Data Transfer File for AI Services
Supporting documents: AI Data Processing Agreement (DPA)
AI Vendor Service Level Agreement (SLA)
Verification: Verified in the official source on November 2, 2026Checked on the ANPD's official site: Res. 19/2024, art. 2, sole paragraph (12 months from publication to adopt standard clauses) and transfer mechanisms. Res. 32/2026 (Jan 26, 2026), recognizing the EU as adequate, appears in the ANPD's official list.