International data transfer: what the LGPD says and how companies should comply

International data transfer is the sending of personal data, whether of customers, suppliers or employees, from Brazil to outside the country, or from one country to another, by any means: cloud storage outside Brazil, remote access through a system hosted abroad, sharing with a multinational's headquarters, or integration between ERPs in different countries. The LGPD (Brazil's General Data Protection Law) addresses this topic in articles 33 to 36, and since 2024 the National Data Protection Authority (ANPD) has been detailing, through resolutions, how this transfer should happen in practice.

It looks like a legal-only matter. It isn't. Every time a company rolls out a global ERP, such as an SAP with a single template for all subsidiaries, or contracts a cloud tool hosted in the United States, it is carrying out an international data transfer, whether it realizes it or not.

When the LGPD demands attention

The law authorizes sending data outside Brazil in a few situations. The most straightforward is when the destination country has a level of data protection considered adequate by the ANPD. In January 2026 the ANPD published Resolution CD/ANPD no. 32, recognizing the countries of the European Union as adequate, which makes life easier for companies with European headquarters or partners. Outside that short list of countries, the transfer depends on specific safeguards: standard contractual clauses approved by the ANPD itself, global corporate rules, international seals and certificates, or specific legal grounds, such as performance of a contract or compliance with a legal obligation.

Anyone who signed a data processing contract with a technology vendor abroad was required to update that contract to include the ANPD's standard clauses by August 2025. That deadline has already passed. If your company has not yet reviewed its contracts for cloud, CRM, MDM platform or any system that stores data outside Brazil, this is a real point of concern, not a theoretical one.

How it works in practice inside the company

Picture a Brazilian manufacturer headquartered in Germany, running SAP with a global template. The customer master record created at a plant in Brazil replicates automatically to the central system, hosted in a data center in Europe. That flow is, technically, an international transfer of personal data, whenever the customer or business contact record includes an individual's name, CPF (Brazil's individual taxpayer ID), email or phone number.

The same goes for a retail chain that uses a customer service platform hosted in the United States, for a consumer goods multinational that centralizes the supplier master in a regional hub outside Brazil to standardize vendor approval across countries, or for a Brazilian company that starts exporting and begins sharing foreign customer records with the local distributor.

I have seen ERP implementation projects stall at the contract signing stage because nobody in IT could say clearly where the Brazilian customer's data went after leaving the local system. That question, which seems simple, only has an answer when serious data mapping has been done, not an outdated diagram sitting in a folder nobody has opened in two years.

Who is responsible for this compliance

It's not a task for legal alone, nor for the data protection officer (DPO) alone. Compliance on international transfer takes a team. The DPO defines the legal basis and manages the relationship with the ANPD. Legal negotiates and signs the contractual clauses with each supplier and partner abroad. IT and the data architect map where each data flow passes, from which system to which system, in which country. And the data steward makes sure the records feeding those flows, mainly master data on customers, suppliers and employees, are correct and classified before they leave the country.

Without that mapping done together, the company signs a generic contract, believes it is protected, and discovers two years later that a new module of the same system, activated without notice by IT, is sending a different type of data to a server that never made it into the original legal analysis.

How technology helps control the flow

Governance and data catalog tools, such as Collibra, Alation and Microsoft Purview, help automatically map where each piece of data originates, where it travels and where it is stored, including the geographic location of the servers. MDM platforms, such as SAP MDG, Informatica, Stibo Systems, Reltio, Semarchy and Profisee, centralize the customer, supplier and material master, which makes it easier to know exactly which data is being replicated to which system, in which country, even before legal sits down to negotiate the contractual clause.

This doesn't replace legal analysis. It replaces guesswork. A company that knows precisely which master data travels outside the country negotiates the contractual clause better, because it knows exactly what it is protecting and can prove it to the ANPD if it is ever audited.

How to learn about the topic

If you work with master data, governance or master records and want to understand international data transfer in practice, you can follow three complementary paths. The first is to study the text of the LGPD and the ANPD's resolutions on the subject directly, available on the government website. The second is to pursue a reference certification in data management, such as DAMA's CDMP, which covers privacy and data protection within a broader body of governance knowledge. The third, and the most important, is to closely follow how your own company maps and documents its international data flows, because theory without application to real records turns into loose knowledge.

Career opportunities on this topic

Professionals who understand LGPD, data governance and the architecture of corporate systems like SAP, Oracle and TOTVS all at once are still rare in the Brazilian market. The combination of legal knowledge with technical knowledge of where master data originates and where it travels opens up room in data compliance, corporate governance and data architecture, with growing demand at multinational companies and at Brazilian groups expanding their operations abroad.

Main questions about international data transfer

Does every company that uses an international cloud need to worry about the LGPD? Yes, if the storage or processing server is outside Brazil and the data is personal, even if it's only the name and email of a business contact.

Is transfer to the United States prohibited by the LGPD? It is not prohibited, but the United States is not on the ANPD's list of adequate countries either. In that case the company must use another safeguard, such as standard contractual clauses.

Does the person who signs the contract with the foreign vendor need to know about the LGPD? They need, at the very least, to know this legal requirement exists and to involve legal and the DPO before signing the contract, not after.

Does supplier data for a legal entity fall under this rule? The LGPD protects the data of individuals. But the supplier master almost always carries the contact of an individual, such as the sales representative, which already brings the obligation into the process.

Do small and mid-sized companies also need to comply? Yes, under the same law, but the level of formality of the compliance program can be proportional to the size and risk of the operation.

MDM Academy: where to go deeper on master data governance

MDM Academy is 4MDG's school of data governance and master data, created to train the professional that the Brazilian market still doesn't have in sufficient numbers. There, the content blends what the law requires with what a company's real master records need to work, from the basics of the LGPD to the practice of data cleansing, taxonomy and master data modeling for customers, suppliers and materials.

If you want to understand a real project from the inside, with case studies of companies that already deal with multinational master data and data transfer between countries, you will find that at MDM Academy. For those who prefer to start with free content before enrolling in any course, Data Club brings together master data and governance professionals every week to share real experience on these topics.

Conclusion

International data transfer is no longer a matter for a foreign headquarters far removed from Brazilian reality. It is a direct consequence of using a global ERP, contracting an international cloud or selling to a customer outside the country. The LGPD has already defined the rules, the ANPD is detailing the mechanisms, and the contract compliance deadline has already passed for many companies.

The blind spot remains the same as always. Nobody controls an international data transfer they don't know exists. Before signing any contractual clause, it's worth asking the simplest question of all, the same one that stalls so many SAP projects: where does your customer's data actually pass through, from Brazil all the way to the final server?