According to the General Data Protection Law (Law. No. 13,079/2018), Article 33(I), the cross-border transfer of personal data is possible if the destination country ensures adequate data protection, which means an essentially equivalent level of protection to that applied in the exporting country. Also, the Sole Paragraph of the same Article 33 determines that, for the purposes of item (I) mentioned before, legal entities governed by public law referred to in the Sole Paragraph of Article 1 of Law No. 12,527/2011 (Access to Information Law), within the scope of their legal competences, may request the National Data Protection Authority (Autoridade Nacional de Proteção de Dados - ANPD) to assess the level of protection of personal data conferred by a country or international body. When issuing adequacy decisions, the Authority must take into consideration (Article 34):I - the general and sectoral rules of the legislation in force in the country of destination or in the international organisation;II - the nature of the data;III - compliance with the general principles of protection of personal data and the rights of holders provided for in this Law;IV - the adoption of security measures provided for in regulations;V - the existence of judicial and institutional guarantees for the respect of personal data protection rights;VI - other specific circumstances relating to the transfer.Law No.13,079/2018 enterred into force on 18/09/2020. Link to Law No. 12,527/2011 (Access to Information Law): https://www.planalto.gov.br/ccivil_03/_ato2011-2014/2011/lei/l12527.htm