International transfer of personal data is allowed only: to countries or international bodies with an adequate level of protection recognised by the ANPD; where the controller offers and proves guarantees of compliance with the principles, rights and regime of the law through specific contractual clauses, standard contractual clauses, global corporate rules, or regularly issued seals, certificates and codes of conduct; for international legal cooperation between intelligence, investigation and prosecution bodies; to protect life or physical safety; with ANPD authorisation; under an international cooperation agreement; to execute a public policy or legal attribution of the public service, with publicity under Art. 23 I; with the data subject's specific and highlighted consent after prior information on the international character of the operation; or to meet the Art. 7 II, V and VI bases. The ANPD assesses adequacy and approves clauses and rules; changes to the guarantees presented as sufficient must be communicated to the ANPD. The ANPD recognised the European Union and the EEA (Iceland, Liechtenstein and Norway) as adequate by Resolution CD/ANPD 32 of 26 January 2026, excluding transfers solely for public safety, national defence, state security or criminal investigation, with reassessment within four years.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.