Brazil's Data Protection Authority Issues Rules Clarifying Data Transfers

Wondering what the requirements are for transferring personal information out of Brazil? Under the country's Data Protection Law, extra-territorial transfers of personal information are regulated in much the same way as in EU Member States. Parties can transfer personal information from Brazil to a third country only in limited circumstances. This includes, among other scenarios, if the entity receiving the information is located in a country that has been deemed adequate or if the parties put in place approved standard contractual clauses.

There have been questions for both of these, which were recently addressed through rulemaking by the Brazilian data protection authority:

• Adequacy: Currently, no country has been deemed adequate, although Brazil is working with the EU to establish that the EU's privacy laws meet the adequacy level. Similarly, the EU is working to recognize Brazil's law as adequate. Under the new rules, to make the process run more smoothly,