LGPD, international transfer of data

Lei nº 13.709, de 2018 (LGPD), arts. 33-36 (international transfer of data)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 18 September 2020.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Transfer personal data outside Brazil only to a country or organization with an adequate level of protection, or under contractual clauses, corporate rules, or another article 33 safeguard.
Where you rely on standard contractual clauses, specific contractual clauses, global corporate rules, or a certification seal for a transfer, use only a form the ANPD has verified or approved, and report any change to those safeguards to it.
Get the data subject's specific, highlighted consent before an international transfer that does not rest on an adequacy finding or another article 33 safeguard, telling them in advance that the operation is international.

What it reaches

Obligation class

Transfer, Access restriction

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 33 permits international transfer of personal data only to a country or international organization offering an adequate level of data protection, where the controller proves compliance through specific or standard contractual clauses, global corporate rules, or a certification seal, for international legal cooperation among investigative or prosecutorial bodies, to protect life or physical safety, where the ANPD authorizes the transfer, under an international cooperation commitment, for a public-policy purpose given publicity, or with the data subject's specific, highlighted consent given after being told the operation is international.

Article 34 requires the ANPD to weigh the destination country's or organization's general and sectoral rules, the nature of the data, the LGPD's principles and rights, its security measures, and its judicial and institutional guarantees before finding its protection adequate.

Article 35 gives the ANPD authority to define standard contractual clauses and to verify specific clauses, global corporate rules, or certification seals, including through a certifying body it may designate and review, and article 36 requires any change to safeguards the ANPD accepted as sufficient to be reported to it.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot

Read the law

Official compiled text of Lei nº 13.709/2018, Presidência da República

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app