Brazil's LGPD Standard Contractual Clauses Explained

Do You Need Brazilian SCCs for Every International Transfer?

No. Start with the transfer architecture, not the contract template.

Resolution 19 says the controller must verify whether the operation is actually an international transfer, whether Brazilian data-protection law applies, and whether both a valid legal basis and a transfer mechanism support it. Operators must assist with information necessary for that assessment.

Legal basis and transfer mechanism are two different layers

Suppose a Brazilian company sends employee data to a U.S. HR SaaS provider. The organization might identify an Article 7 legal basis for the HR processing. That still does not answer the international-transfer question.

The company also needs a valid Article 33 mechanism. Brazilian SCCs may be that mechanism, but another mechanism may be available depending on the facts.

Adequacy can remove the need for SCCs as the transfer mechanism

If ANPD has recognized the destination as adequate and the transfer fits that decision, adequacy can serve as the international-transfer mechanism. As of August 2026, ANPD's public repository identifies the European Union as adequate under Resolution No. 32/2026.

This does not eliminate the rest of the LGPD. The processing still needs its purpose, legal basis, minimization, transparency, security, rights and other applicable controls.

What Is the Current Status in 2026?

Resolution 19 took effect when published in August 2024. It gave processing agents that were already using contractual clauses for international transfers up to 12 months from publication to incorporate the ANPD-approved SCCs into their contracts.

That transition period has already expired. For a 2026 compliance review, “we still plan to update our old contract” should therefore be treated as an open remediation item, not as a current transition right.

The official Resolution page currently notes that the text was corrected by the August 18, 2025 rectification. Companies should use the current official text rather than an old downloaded copy.

Equivalent foreign SCCs: none recognized yet

Resolution 19 allows ANPD to recognize standard clauses issued by another country or international organization as equivalent to the Brazilian SCCs. But ANPD's current transfer repository says that, to date, no equivalent foreign standard contractual clauses have been recognized.

Specific clauses and BCRs: also none approved yet

The same public repository currently states that ANPD has not yet approved any specific contractual clauses or binding corporate rules / global corporate rules.

This makes the Brazilian SCCs especially important for companies transferring data to non-adequate destinations when no other Article 33 mechanism fits.

Who Are the Exporter and Importer?

Resolution 19 defines the exporter as a processing agent located in Brazil or abroad that transfers personal data to an importer. The importer is a processing agent located in a foreign country, or an international organization, that receives the data.

This is broader than a simplistic:

Brazilian company = exporter / foreign vendor = importer.

That is a common scenario, but not the only one. Because the exporter can itself be outside Brazil, a multinational chain can still fall within the Regulation where the LGPD applies to the transfer.

International collection is different

Resolution 19 also distinguishes international collection: direct collection from the data subject by an agent located abroad. Article 6 of the Regulation says that international collection, by itself, is not characterized as an international transfer.

However, the LGPD can still apply to that direct collection when Article 3's territorial conditions are satisfied.

Which Controller / Operator Combinations Do the Brazilian SCCs Support?

Annex II asks each party to identify itself as controller or operator. The responsibility section then provides two options depending on the structure.

The operator-to-operator option is especially important for SaaS chains

Consider:

Annex II's Option B recognizes this type of structure. The exporter/operator must identify the third-party controller and confirm that the transfer is made according to that controller's written instructions.

The two operators must also assist with data-subject requests and provide information necessary for the controller to comply with ANPD requirements, transparency, rights and incident duties.

How Annex II Is Structured

Annex II is not simply a page of boilerplate. It is divided into four sections with different functions.

Section IV allows additional clauses and annexes, including commercial terms, termination, duration and a forum in Brazil. But those additional terms cannot directly or indirectly exclude, modify or contradict Sections I–III.

Can the SCCs be inserted into a DPA?

Yes. Article 16 says they can be part of a contract specifically for international transfers, or a broader agreement—including an addendum—between exporter and importer.

If the SCCs are incorporated into a broader contract, Sections I, II and III of Annex II must appear as an annex to the signed instrument.

Can companies add commercial clauses?

Yes. They can add terms on price, service levels, liability allocation between the parties where lawful, termination, duration and other commercial matters.

But the added contract cannot undermine the SCCs. A clause saying, for example, that the importer has no obligation to support data-subject rights where the SCCs require support would create a conflict.

What Information Must Be Completed in Section I?

Section I asks the parties to provide practical transfer information, including:

• identity and contact details of exporter and importer;
• whether each is controller or operator;
• a description of the international transfer;
• main purposes;
• categories of personal data transferred;
• storage period;
• onward-transfer choice and details where allowed; and
• responsibility allocation for transparency, rights and incident communication.

What Do the Mandatory Clauses Cover?

Section II runs through Clause 24 and creates the core protection framework. Major topics include:

Onward Transfers and Subprocessors

One of the most operationally significant parts of the Brazilian SCCs is Clause 18. An importer cannot treat the original transfer as a blank check for unlimited downstream transfers.

Section I asks the parties to choose whether onward transfers are prohibited except where another valid mechanism applies, or permitted under specified conditions.

Where an onward transfer is authorized under the SCC structure, the importer must:

• keep the onward purpose compatible with the purpose described in the original SCCs;
• use a written contract to make the downstream recipient observe the SCC safeguards; and
• accept responsibility under the SCCs for irregularities by that downstream recipient in relation to the transferred data.

Clause 18 also allows an onward transfer to rely on another valid international-transfer mechanism, independently of the authorization route in Clause 3.

Public Transparency Obligations

Signing Brazilian SCCs creates public-facing obligations too.

Article 17 of the Regulation requires the controller to provide the full clauses to a data subject on request, subject to commercial and industrial secrets, within 15 days unless another specific ANPD regulation sets a different period.

The controller must also publish a Portuguese-language document, in simple, clear, precise and accessible language, explaining at least:

• the form, duration and specific purpose of the international transfer;
• the destination country;
• controller identity and contact information;
• shared use of data and its purpose;
• the responsibilities of the processing agents and security measures; and
• data-subject rights and the channel for exercising them.

That information can appear on a dedicated page or in a clearly highlighted and easily accessible part of the privacy policy or equivalent document.

The SCCs themselves add onward-transfer transparency

Clause 14 goes further by requiring information about onward transfers, including recipients and purposes, and says information provided under the clauses must be in Portuguese.

Government Access Requests and Destination-Country Law

The Brazilian SCCs contain specific rules for legally compelled access in the destination country.

Clause 19 requires the importer to notify the exporter and data subject about an access request, unless the destination country's law prohibits that notification. Where there is an appropriate legal basis to challenge the request or a non-disclosure restriction, the importer must take available legal measures, including judicial measures.

The importer must also keep records of access requests, including information such as date, requester, purpose, types of data requested, number of requests and legal measures taken.

The importer also makes a destination-law declaration

Clause 22 says the importer declares that it has not identified laws or administrative practices in the destination country that prevent it from complying with the SCCs. If a legal change later alters that position, the importer must immediately notify the exporter so the parties can evaluate whether the transfer can continue.

This means the SCC exercise should not be reduced to signatures. The importer needs to understand whether destination-country legal requirements can interfere with the promised safeguards.

Security Measures in Section III

Section III is where the parties describe the technical and administrative security measures used for the transferred data. The SCCs specifically call for attention to:

• the nature of the information;
• the characteristics and purpose of processing;
• current state of technology;
• risks to data-subject rights;
• sensitive personal data; and
• children's and adolescents' data.

The Annex gives two broad headings: governance and supervision of internal processes and technical and administrative security measures for operations such as collection, transmission and storage.

This is a good place to connect the SCC to the organization's broader security evidence rather than using vague language such as: “industry-standard security applies.”

See LGPD Security Requirements: What Businesses Are Expected to Do.

Deletion and End of Processing

Clause 20 mirrors the LGPD's end-of-processing logic. The parties must delete transferred personal data after processing ends within the scope and technical limits of the activity, subject to the specified conservation purposes.

The SCCs identify termination when:

• the purpose is achieved;
• the data is no longer necessary or relevant to that purpose;
• the processing period ends;
• a data-subject request is satisfied; or
• ANPD determines termination after a violation.

This is why the SCC Section I asks for the storage period. Transfer contracts should connect to the company's actual retention schedule and vendor deletion behavior.

See LGPD Data Retention: How Long Should Personal Data Be Kept?.

Brazil-to-U.S. Transfers: Are SCCs Required?

As of August 2026, ANPD's public adequacy repository identifies the European Union as adequate. It does not list the United States as an adequate destination.

Therefore, a Brazil-to-U.S. transfer cannot rely on an ANPD U.S. adequacy decision that does not exist. The organization needs another applicable Article 33 mechanism.

Brazilian SCCs can be an important solution for:

• Brazilian company → U.S. SaaS processor;
• Brazilian controller → U.S. affiliate controller;
• Brazilian processor → U.S. subprocessor;
• foreign company subject to the LGPD → another foreign importer where the Regulation applies; and
• other non-adequate destination structures where a contractual mechanism is appropriate.

Brazilian SCCs vs EU SCCs

Common LGPD SCC Mistakes

“We signed an ordinary DPA, so transfer compliance is covered.”

Not necessarily. A DPA can govern controller/operator obligations without constituting a valid Article 33 transfer mechanism.

“Our EU SCCs automatically cover Brazil.”

Not currently. ANPD says no equivalent foreign standard clauses have yet been recognized.

“The SCCs are the legal basis.”

No. Resolution 19 requires an Article 7 or Article 11 legal basis plus a transfer mechanism.

“We can edit the Brazilian SCC language to fit our global template.”

Not if you rely on the Brazilian SCC mechanism. Article 16 requires the Annex II text in full and without alteration.

“Our subprocessor is listed, so onward transfer is solved.”

Listing a subprocessor does not by itself satisfy the onward-transfer safeguards and transfer-mechanism requirements.

“Only a Brazilian entity can be an exporter.”

Resolution 19 expressly defines an exporter as a processing agent located in Brazil or abroad.

“The privacy policy can stay English-only.”

Resolution 19 creates a specific Portuguese-language transparency requirement for international transfers.

20-Point Brazilian SCC Implementation Checklist