Brazil ANPD Issues Resolution 19 for Cross-Border Data Transfers
Updated
Updated · Littler Mendelson PC · Jun 24
Brazil ANPD Issues Resolution 19 for Cross-Border Data Transfers
1 articles · Updated · Littler Mendelson PC · Jun 24
Summary
Brazil’s data protection authority has put Resolution 19 into effect, creating a formal framework for when personal data can leave the country and which legal mechanisms companies must use.
Standard contractual clauses are expected to become a main compliance tool under the new regime, especially for employers sending payroll, HR, benefits and cloud-stored employee data to affiliates or vendors abroad.
Brazilian companies are being pushed to map direct and onward data transfers and add safeguards for third-party service providers, as cross-border data handling becomes more central to daily employment operations.
Litigation under Brazil’s LGPD has already been rising in labor courts, with disputes spanning employee monitoring, geolocation, background checks, biometrics and data-driven workplace decisions.
The resolution marks a broader maturation of Brazil’s privacy regime, giving multinationals more legal certainty even as AI use and workplace data practices increase pressure for transparency and compliance.
As data laws diverge, how can global firms avoid billion-dollar fines when employee data crosses borders from Brazil to the US?
With AI tools processing global data, what stops your company’s confidential information from becoming part of their next training model?
Brazil’s Cross-Border Data Transfers in 2025: ANPD Independence, Resolution 19/2024, and Global Alignment
Overview
Brazil’s data transfer landscape is rapidly evolving, driven by the ANPD’s transformation into an independent regulatory agency and the introduction of new legal measures. This shift has made the ANPD a leading force in Brazil’s digital ecosystem, moving beyond its experimental phase to enforce data protection more robustly. As a result, businesses face a fundamentally changed compliance environment, especially for international data transfers. The ANPD’s formal adequacy decisions can simplify transfers to recognized destinations, while new regulations add layers to the legal framework, requiring companies to carefully review and update their data transfer practices to ensure compliance.