LGPD Article 33: the only cases in which personal data may be transferred abroad (Lei Geral de Proteção de Dados, Law No. 13,709 of 14 August 2018, Art. 33, I, II and VIII (ANPD English translation))
Sending personal data to a US buyer needs an adequacy decision, approved contract clauses (standard, specific or binding corporate rules), the data subject's specific and distinguishable consent to the transfer, or another listed case. The licence itself therefore has to carry one of these before the lot is delivered.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“The international transfer of personal data is only allowed in the following cases: I - to third countries or international organizations that provide a level of protection of personal data that is adequate to the provisions of this Law; II - when the controller offers and demonstrates guarantees of compliance with the principles, the rights of the data subject and the regime of data protection provided in this Law, in the form of: a) specific contractual clauses for a given transfer; b) standard contractual clauses; ... VIII - when the data subject has provided specific and distinguishable consent for such transfer, with previous information on the international nature of the intended operation, clearly distinguishing it from other purposes”
Where it was read
Also read from the same source
- LGPD Article 7: the legal bases for processing personal data, including consent (I) and the controller's legitimate interest (IX) (Lei Geral de Proteção de Dados, Law No. 13,709 of 14 August 2018, Art. 7, I and IX (ANPD English translation))
- LGPD Article 12: anonymised data is not personal data unless the anonymisation can be reversed with reasonable efforts (Lei Geral de Proteção de Dados, Law No. 13,709 of 14 August 2018, Art. 12 and Art. 12, par. 1 (ANPD English translation))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide