Data Processing Agreement in Brazil: Template, Key Clauses and Local Law (2026)

A data processing agreement (DPA) in Brazil is the contract that governs how an operator processes personal data on behalf of a controller. It is the main instrument for showing that processing meets the General Data Protection Law (LGPD), Law 13.709/2018. Brazil uses a controller and operator structure similar to the EU GDPR, and a reformed international transfer regime now provides standard contractual clauses issued by the data protection authority. This guide explains the Brazilian legal framework, the clauses a DPA should carry, and a template skeleton. It is general information, not legal advice. ## What law governs a data processing agreement in Brazil? The framework is: - The General Data Protection Law (LGPD), Law 13.709/2018, which defines the controller (controlador), who decides the purposes and means of processing, and the operator (operador), who processes on the controller's behalf (Article 5). The operator must follow the controller's instructions, and both are accountable for security and for damage caused by processing.

• Security and governance duties (Articles 46 to 50). Controllers and operators must adopt technical and administrative security measures, and the law encourages good practice and governance programmes.
• The National Data Protection Authority (ANPD), the supervisory body that issues regulations and guidance.
• The international transfer regime (Article 33) and ANPD Resolution CD/ANPD No. 19/2024, which set the routes for transferring personal data abroad: an adequacy decision, standard contractual clauses (SCCs) issued by the ANPD, specific contractual clauses, or binding corporate rules. The regulation gave a grace period to amend existing contracts to add the clauses. ## Is a data processing agreement required in Brazil? In practice yes, whenever a controller lets an operator process personal data for it. The LGPD makes the operator process only on the controller's instructions and holds both accountable for security and for damage, so those duties have to be set in writing to be workable and to show compliance. ## Key clauses in a Brazilian data processing agreement ### Roles and subject matter Name the controller and operator, and describe the processing: its purpose, duration, the categories of data and data subjects (titulares). ### Processing only on instructions State that the operator processes only on the controller's documented instructions and within the stated purpose. ### Security measures Set the technical and administrative measures under Articles 46 to 50, including access controls, encryption and staff confidentiality. ### Incident notification Require the operator to notify the controller of a security incident promptly, so the controller can meet its duty to report to the ANPD and affected data subjects. ### Suboperators Require prior approval of suboperators and flow-down of the same obligations. ### International transfers Address any transfer abroad through a lawful route under Article 33 and Resolution No. 19/2024: an adequacy decision, ANPD standard contractual clauses, specific clauses, or binding corporate rules. ### Data subject rights and assistance Require the operator to help the controller answer data subject requests under the LGPD. ### Audit, records and accountability Give audit rights and require records that evidence compliance, since both parties must prove it. ### Return and deletion Require the operator to return or delete the data at the end of processing, consistent with LGPD retention rules. ## Template skeleton ```

1. Parties and definitions
2. Subject matter and duration of processing
3. Roles: controller and operator
4. Processing only on documented instructions
5. Security measures (Articles 46 to 50)
6. Security incident notification
7. Suboperators
8. International transfers (Article 33 and Resolution 19/2024)
9. Data subject rights and assistance
10. Audit, records and accountability
11. Return and deletion of data
12. Liability and term
13. Governing law (Brazil) and dispute resolution
14. Signatures

- **Both parties are accountable.** The LGPD can hold the controller and operator responsible for damage caused by processing, so security and indemnity terms matter.
- **International transfers now have SCCs.** Resolution CD/ANPD No. 19/2024 issued standard contractual clauses that must be adopted unchanged to be valid, with a grace period to retrofit existing contracts.
- **Check the ANPD's current position.** Adequacy decisions and recognition of foreign clauses evolve, so confirm the route against the ANPD before relying on it. ## Common mistakes to avoid - Copying an EU GDPR DPA word for word without mapping it to LGPD roles and the Article 33 transfer routes.
- Altering the ANPD standard contractual clauses, which must be adopted unchanged to be valid.
- Leaving suboperator approval and deletion duties vague.
- Treating incident notification as discretionary instead of a prompt duty. ## From the schedule to the processing you actually run Signing the DPA is one moment; keeping it true is continuous. Suboperators change, transfer routes get amended, and incident timelines have to be met. Across many vendor DPAs, tracking which version is current and which transfer basis applies is easy to lose. An AI contract workspace keeps each DPA, its security and transfer schedules, its suboperator list and its review dates in one place, so you can draft from a template, see where terms are weak, edit in plain language and get a reminder before a deadline. If you want to see drafting, review, tracking and governance in a single workspace, [Adira](https://adiralaw.com) is built around that idea. Deep Brazil-specific jurisdiction coverage is on Adira's roadmap today; India is deepest now. ## FAQ