Brazil has enacted its first data protection legislation, which provides for the protection of the data of individuals and private and public legal organizations. The General Data Protection Law (Law No. 13.709/2018) will become effective on February 14, 2020.
Application: The law is applicable to any activity that involves the transfer of “personal data,” which is broadly defined and encompasses transfer of data of individuals and private and public legal entities. The law applies to companies headquartered Brazil, foreign affiliates located in Brazil and companies located outside of Brazil that offer or provide goods or services to individuals or entities located in Brazil or that collect or process personal data of data subjects in Brazil. Like similar comprehensive data protection laws, it imposes restrictions on the international transfer of data. It permits the exchange of data with countries or international organizations that provide an appropriate level of protection for personal data, or that provide assurances for the protection of personal data. Standard contractual clauses, global corporate standards, seals, certificates or codes authorized by the national data protection authority are considered appropriate assurances for cross-border data transfers.