The Brazilian Regulation on Cross Border Transfers of Personal Data
Key Points to consider when transferring Brazil personal data internationally 下載檔案PUBLIC
The Brazilian Regulation on Cross Border
Transfers of Personal Data
Key Points
Version: 2.0
Date: 2025-09-02
The information contained in this document is for general informational purposes only and is provided on the
understanding that SAP is not engaged in rendering legal advice. SAP accepts no liability for any actions
taken in response to this resource. As such, it should not be used as a substitute for legal or professional
consultation.
The Brazilian Regulation on Cross Border
Transfers of Personal Data
Key Points
Version: 2.0
Date: 2025-09-02
The information contained in this document is for general informational purposes only and is provided on the
understanding that SAP is not engaged in rendering legal advice. SAP accepts no liability for any actions
taken in response to this resource. As such, it should not be used as a substitute for legal or professional
consultation.
© 2025 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to this material. 2 / 2
Legal Bases for International Personal Data Transfers
. Under this Resolution, international personal data transfers rely on one of the following legal bases:
Adequacy decision,
Standard Contractual Clauses (Brazil SCCs),
Specific Contractual Clauses,
or Binding Corporate Rules (BCRs).
After careful evaluation, SAP applies the use of Brazil SCCs in its customer relationships where necessary.
Structure of the Brazil SCC
Brazil SCCs are organized into four main sections:
General Information, includes party details and the nature of data processing;
Mandatory Clauses, non-negotiable baseline data protection standards;
Security Measures, technical and organizational measures for data protection; and
Additional Clauses and Annexes for supplemental terms consistent with mandatory clauses.
Brazil SCC vs. European Union standard Contractual Clauses (EU SCC)
Unlike the EU’s SCC modular structure, the Brazil SCCs follow a role-based model with two modules:
Module A (Controller-to-Controller / Controller-to-Processor): Requires Controllers to ensure LGPD
compliance, transparency, and security, with responsibilities designated to Exporter/Importer;
Module B (Processor-to-Processor): Requires the Exporter to follow instructions from Third-Party
Controller , remain liable for compliance and assist with legal obligations
SAP’s Approach to Implementing the Brazil SCC
Where necessary, SAP will sign an amendment to the Data Processing Agreements with its customers
referencing the application of the Brazil SCCs to ensure compliance with the Regulation.
For further information, contact your account executive or visit the SAP Trust Center (Data Protection and
Privacy) at www.sap.com.
Legal Bases for International Personal Data Transfers
. Under this Resolution, international personal data transfers rely on one of the following legal bases:
Adequacy decision,
Standard Contractual Clauses (Brazil SCCs),
Specific Contractual Clauses,
or Binding Corporate Rules (BCRs).
After careful evaluation, SAP applies the use of Brazil SCCs in its customer relationships where necessary.
Structure of the Brazil SCC
Brazil SCCs are organized into four main sections:
General Information, includes party details and the nature of data processing;
Mandatory Clauses, non-negotiable baseline data protection standards;
Security Measures, technical and organizational measures for data protection; and
Additional Clauses and Annexes for supplemental terms consistent with mandatory clauses.
Brazil SCC vs. European Union standard Contractual Clauses (EU SCC)
Unlike the EU’s SCC modular structure, the Brazil SCCs follow a role-based model with two modules:
Module A (Controller-to-Controller / Controller-to-Processor): Requires Controllers to ensure LGPD
compliance, transparency, and security, with responsibilities designated to Exporter/Importer;
Module B (Processor-to-Processor): Requires the Exporter to follow instructions from Third-Party
Controller , remain liable for compliance and assist with legal obligations
SAP’s Approach to Implementing the Brazil SCC
Where necessary, SAP will sign an amendment to the Data Processing Agreements with its customers
referencing the application of the Brazil SCCs to ensure compliance with the Regulation.
For further information, contact your account executive or visit the SAP Trust Center (Data Protection and
Privacy) at www.sap.com.