The sending of personal data to another country or international organization is only permitted under the provisions of the LGPD (Brazilian General Data Protection Law).
International data transfer is the transfer of personal data to a foreign country or international organization of which the country is a member, including when done for storage in cloud services outside of Brazil.
Using an email, CRM, or cloud provider with servers located abroad already constitutes international data transfer. That's why this topic comes up in almost every organization, even those without operations outside the country.
Articles 33 to 36 of LGPD The following hypotheses are listed: countries with an adequate level of protection recognized by the ANPD (Brazilian National Data Protection Authority), specific or standard contractual clauses, global corporate rules, seals and certifications, international legal cooperation, protection of life, authorization from the ANPD, international commitment, execution of public policy, specific and explicit consent, and compliance with a legal obligation or contract. Resolution CD/ANPD No. 19/2024, available at [link to resolution]. ANPD website, approved the standard contractual clauses and the suitability assessment procedure.
O Data Mapping It records the international transfers for each activity and the hypothesis applied; Third Party Risk Management It documents the overseas suppliers and the signed clauses.
Operator · GDPR · ROPA · Controller · Back to glossary
Updated .
Request a demo and see how... Privacy Tools It organizes mapping, legal bases, rights holder applications, and evidence all in one place.
