BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
Remote access is another hot topic. As a rule, remote access is considered an international transfer of data, especially personal data. Under the LGPD, access (which is a form of processing, Article 5, X) does not require data and those who access it to be in the same country. It follows that access from Brazil to personal data in another country does constitute an internation - al transfer and is therefore subject to the requirements of the LGPD and Resolution No 19 of the ANPD. 5.4 Blocking Statutes Blocking statutes are basically legal norms adopted by a country or economic bloc to prevent or nullify the effects of the legislation of other countries that try to impose sanctions or trade restrictions, which can protect local companies or economic sectors from foreign penalties or sanctions. There are different mechanisms for the recognition of foreign court decisions and data protection laws (especially governing personal data) that greatly restrict foreign discovery, compliance with sanctions, and the cross-border transfer of personal and non- personal data. In practice, it is a safeguard based on the principle of extraterritoriality, whose main mission is to protect national sovereignty, commercial and industrial secrets and the privacy of citizens. Some countries, such as Canada, China, and France, have passed laws prohibiting citizens and companies from providing documents or information to foreign court proceedings unless under international treaties such as the Hague Convention on the Taking of Evi - dence Abroad. In Brazil, the Federal Supreme Court continuously reaffirms that foreign laws and acts do not have automatic legal effects in Brazil, since they depend on a local homologation process or, at least, on international co-operative acts. The blocking rules, even if they were not created with personal data in mind, act as a “formal reinforce - ment” of the legislation for the protection of this data. A good example of this is the LGPD, which prohibits the international transfer of personal data to countries
that do not guarantee an adequate level of protection similar to that of Brazil. In this sense, the discovery (the production of evidence) that involves or depends on personal data, without valid authorisation, violates the LGPD. 5.5 Recent Developments In terms of the international transfer of personal data, the most recent development, which is highlighted in Brazil and the European Union, is that both parties have recognised that their frameworks for the protec - tion and safeguarding of personal data are “materially equivalent” and ensure an adequate level of protec - tion (decision of the European Parliament of 1/26/26 and ANPD Resolution 32). Another development refers to the EU-US Data Pri - vacy Framework (DPF), whose validity was upheld in September 2025 by the General Court of the Euro - pean Union, which reinforces legal certainty for EU-US transfers. Other developments are also underway, for example: • the transfer of non-personal data to more advanced research countries; • “relativised” international transfer where the data is “dual-localised”, stored in the country of origin and in a destination country; and • transfer for an essential period. In addition, changes are expected in the near future: • intensification of regulatory oversight of the ANPD; • more requirements for personal data mapping and privacy impact reports; • stricter obligations for personal data policies; • ANPD must publish a list of countries considered safe for data transfers (adequacy decisions); • the DPF may face new legal challenges through activists, despite its retention; • focus on sensitive data and AI; and • emergence of new concepts such as “reserved data” and “data in process”.
25 CHAMBERS.COM
Powered by FlippingBook