Following order no. 2020-192 of March 4, 2020,which modified the issuance methods of the apostille, this competence was transferred to the notariat. The scope of this new mission was specified by decree no. 2021-1205 of September 17, 2021 and by an order dated December 23, 2024The implementation of this system has been effective since May 2025.
COMPETENT AUTHORITIES
Since May 1, 2025, the notaries of France, through 15 Regional Councils or Interdepartmental Chambers, have been responsible for issuing apostilles, a mission previously carried out by the public prosecutors of the 33 courts of appeal:
- Interdepartmental Chamber of Notaries of Nord and Pas-de-Calais
- Interdepartmental Chamber of Notaries of the Court of Appeal of Rouen;
- Interdepartmental Chamber of Notaries of Paris;
- • Interdepartmental Chamber of Notaries of the Court of Appeal of Rennes;
- Inter-regional Council of Notaries of the Courts of Appeal of Colmar and Metz;
- Interdepartmental Chamber of Notaries of Maine-et-Loire, Mayenne, and Sarthe;
- Interdepartmental Chamber of Notaries of Franche-Comté;
- Interdepartmental Chamber of Notaries of the Court of Appeal of Lyon;
- Interdepartmental Chamber of Notaries of Franche-Comté;
- Interdepartmental Chamber of Notaries of Ariège, Haute-Garonne, Tarn, and Tarn-et-Garonne;
- Regional Council of Notaries of the Court of Appeal of Montpellier;
- Regional Council of Notaries of the Court of Appeal of Aix-en-Provence;
- Regional Council of Notaries of the Court of Appeal of Bastia;
- Departmental Chamber of Notaries of La Réunion;
- Interdepartmental Chamber of Notaries of Guiana and Martinique.
As of May 1, the issuance of apostilles is now an exclusive competence of the notaries of France. The previous option via the public prosecutors of the courts of appeal is no longer available.
WHAT IS AN APOSTILLE?
An apostille is a formality that certifies the authenticity of a public document intended for use abroad, in a country signatory to the Hague Convention of October 5, 1961. It ensures the veracity of the signature, the quality of the signatory, and the authenticity of the seal or stamp on the document. It does not concern the content of the document.
In practice, the apostille takes the form of an official stamp applied to the document. It facilitates the international circulation of acts by eliminating the requirement of legalization between member states of the Hague Convention.
HOW TO OBTAIN AN APOSTILLE?
Since May 1, 2025, there are two ways to request an apostille:
- Online, via the dedicated platform accessible here: Accueil – Portail Grand Public
- Directly at the Apostille Center of one of the 15 Regional Councils or Interdepartmental Chambers of Notaries(an interactive map helps identify the competent Regional Councils or Interdepartmental Chambers, with full contact details: addresses, hours, emails, and phone numbers).).
Guideline of prerequisites by type of act: https://www.notaires.fr/fr/media/1537
Article detailing all steps of the procedure: Légalisation ou apostille d’un acte public établi par une autorité française | Service-Public.fr
PROCESSING TIMES
The apostille is generally issued within 3 working days after verifying the necessary information in the national public signature database, provided that the dossier is complete.
LEGAL FOUNDATION
Navigating the international legal framework, especially for document apostille, can be complex. If you are considering collaborating with Brazil, we are here to assist. Thanks to our partners in France, we can connect you with the necessary resources to facilitate your processes.
PGDAU Notice nº 11/2025 sets advantageous conditions for settling debts with the Federal Union
The Procuradoria Geral da Fazenda Nacional (“PGFN”) has published PGDAU Notice nº 11/2025, effective from May 30, 2025, introducing new transaction modalities for regularizing debts registered within the Federal Union’s active debt list, whether tax-related or not. These modalities offer benefits such as interest, fine, and legal fee reductions, easier upfront payments, and extended deadlines for installments.
This measure aims to encourage defaulters to regularize their fiscal standing, taking into account their payment capacity and the classification of their debts. Applications must be submitted exclusively via the REGULARIZE platform (www.regularize.pgfn.gov.br) between June 2 and September 30, 2025, from 8:00 a.m. to 7:00 p.m. (Brasília time).
Eligible debts and transaction modalities
Tax and non-tax debts registered in the Union’s active debt system are eligible for inclusion, provided the consolidated amount does not exceed R$45 million per taxpayer. The registration date of the debt determines the applicable transaction modality.
Debts registered by 03/04/2025 may qualify for the following modalities:
– Payment capacity transactions;
– Transactions for uncollectible debts;
– Transactions for debts guaranteed by insurance or a guarantee letter.
Debts registered by 06/02/2024 are exclusively eligible for:
– Small-value transactions (up to 60 minimum wages per registration).
The proposals are divided into four main modalities: 1) Payment capacity transactions, 2) Transactions for uncollectible debts, 3) Small-value debt transactions, 4) Transactions for debts guaranteed by insurance or a guarantee letter, as specified in the notice.
| Debts already subject to payment arrangements (installments, previous transactions, guarantees, or legally suspended by court rulings) may be included, provided there is a formal renunciation, as per the deadlines and conditions outlined in the notice. Taxpayers who have had previous transactions rescinded within the past two years, even for different debts, are not eligible for this initiative. |
Additional rules and restrictions
Adherence must cover all eligible debts under the contributor’s name; partial adherence is not allowed.
For debts under judicial litigation, proof of renunciation of legal actions must be provided within 60 days after adherence.
Failure to pay three installments, whether consecutive or not, will result in automatic termination of the agreement.
The minimum installment amount is R$100, except for individual micro-entrepreneurs (MEI), where it is R$25.
Installments will be adjusted according to the monthly accumulated SELIC rate, with an additional 1% applied during the payment month. The contributor must maintain fiscal compliance with Receita Federal and FGTS throughout the agreement’s duration.
Judicial deposits tied to the included debts will be automatically converted into final payments, with discounts applied only to the remaining balance.
Recommendation
The transaction opportunity provided under PGDAU Notice nº 11/2025 represents a strategic option for federal debt regularization, especially for taxpayers with long-standing liabilities, limited payment capacity, or low-value debts. Given the specificities of each modality and their applicable rules, performing an individualized analysis is crucial before adhering.
Our firm is available to provide comprehensive support, including eligibility verification, detailed simulations of payments and discounts, formal adherence procedures, renunciation of legal actions, and full compliance monitoring until the agreement is successfully concluded.
We remain available for any additional clarifications.
GTLawyers – Tax Team
The Data Protection Officer (DPO) is a role established by both Brazilian legislation (General Data Protection Law – “LGPD”) and European legislation (General Data Protection Regulation – “GDPR”). Both laws have their own requirements for the appointment of their DPOs, whether for data controllers or processors. The Data Protection Officer serves as a channel of communication between the data subjects and the public authority responsible for enforcing data protection regulations within the jurisdiction.
Although both legislations mandate the presence of a DPO, there are key differences that companies must be aware of to mitigate risks, avoid legal and administrative penalties, and prevent damage to their reputation. To clarify these distinctions, we have prepared a comparative table regarding the LGPD and the GDPR.
Below, we highlight the main features of these two legislations:
Below, we provide further clarification on the differences between the Data Protection Officer under the GDPR and the LGPD.
OBLIGATION TO APPOINT A DPO
Unlike the GDPR [3], which establishes specific criteria for the designation of a DPO, the LGPD adopts a more general approach, determining that the data controller must appoint a person in charge of personal data protection. This implies that, generally, any public or private organization must appoint a DPO. However, there is an exception established in Resolution CD/ANPD No. 2/2022, which exempts small processing agents [4] from appointing a DPO, while maintaining other obligations defined by the LGPD [5]. Additionally, §3 of Article 41 provides the possibility of additional exemptions, allowing the National Data Protection Authority (“ANPD”) to establish cases where the appointment of a DPO may not be necessary, considering the nature, size, and volume of data processing by the entity.
QUALIFICATIONS AND SKILLS
The role of the DPO under Brazilian legislation is more flexible with fewer stringent requirements compared to Europe, particularly regarding the qualifications of the professional occupying this position. According to Article 7 of Resolution CD/ANPD No. 18/2024, it is the responsibility of the data processing agent to define the qualifications of the DPO based on their knowledge of personal data protection legislation, as well as the context, volume, and risk of the processing operations conducted. This Resolution also establishes that the DPO must be capable of effectively communicating with data subjects and with the ANPD. In Europe, Article 37 of the GDPR imposes more specific requirements, such as the need for specialized knowledge in law and data protection practices, the requirement that qualifications match the complexity and risk of processing activities, the ability to develop and maintain data protection programs, as well as familiarity with technical and organizational measures.
OUTSOURCING THE DPO ROLE
Resolution CD/ANPD No. 18/2024, which regulates the DPO role in Article 12, provides that the DPO may be an individual, either affiliated or not with the organizational structure of the processing agent, or a legal entity [6]. All these options are also permitted under the GDPR [7].
DISCLOSURE OF THE DPO’S CONTACT INFORMATION
The contact details of the DPO must be published on the company’s website under both legislations, ensuring transparency and accessibility for data subjects and authorities. Article 9 of Resolution CD/ANPD No. 18/2024 also allows for disclosure through other communication means if the data controller does not have its own website. The GDPR also requires that the DPO’s contact details be communicated to the authorities.
CONFLICTS OF INTEREST CONSIDERATIONS
Both the General Data Protection Regulation (GDPR) and the Brazilian General Data Protection Law (LGPD) address conflicts of interest influencing the performance of the DPO’s duties. The GDPR includes detailed safeguards to ensure the DPO’s independence, prohibiting them from performing functions that could create a conflict of interest, such as positions where they determine the purposes of personal data processing. Furthermore, the regulation states that the DPO should not be penalized or dismissed for performing their responsibilities [8]. In contrast, the LGPD establishes that the data controller must take steps to mitigate any conflict of interest, with the option to replace the DPO if necessary.
These aspects will be analyzed more thoroughly in a specific article exploring cases and legislation related to conflicts of interest in the context of data protection.
POSITION WITHIN THE ORGANIZATION
Regarding the accumulation of functions, Brazilian legislation does not explicitly prohibit an employee, director, or contractor from being designated as a DPO, provided that the independence of the role is maintained. Similarly, under the GDPR, the DPO may perform other roles within the organization as long as it does not lead to a conflict of interest. This means that, according to European Union legislation, the DPO cannot hold a position where they determine the purposes and means of personal data processing activities, such as a chief executive officer, chief operating officer, or head of human resources, for instance [9].
***
In conclusion, the role of the DPO is crucial for maintaining privacy standards, and a clear understanding of the regulations governing this role is essential for organizations operating in Brazil. Foreign companies entering the Brazilian market should seek local legal advice to ensure compliance with the LGPD, particularly regarding the designation and responsibilities of the DPO.
GTLawyers possess the necessary expertise to provide legal advice and guidance, whether by assisting the DPO in their daily activities or by offering DPO services to mitigate potential conflicts of interest. Our team ensures that companies not only fulfill their legal obligations but also implement effective data protection practices, thereby minimizing legal and reputational risks while maintaining the DPO’s independence and impartiality.
GT Lawyers
Anne Brunschwig
Jessica Ferreira
[1] The Article 29 Working Party (WP29) has issued widely recognized market guidelines on the qualifications of the DPO, indicating that this professional must be capable of creating, implementing, and maintaining a Data Protection Program. Moreover, the more complex or risky the data processing carried out by the data controller, the higher the knowledge and specialization requirements for the DPO will be. Finally, the DPO does not need to be a lawyer, but must be familiar with data protection legislation and technical and organizational measures.
[2] Article 38 of the General Data Protection Regulation (GDPR) stipulates that the DPO must be involved in matters related to the processing of personal data and must act autonomously, without receiving instructions from third parties, regardless of their hierarchical position. In this context, the company must provide the necessary resources for the exercise of their activities. It is also important to emphasize that the DPO cannot be dismissed or penalized for performing their duties. They must report to senior management, and data subjects can contact them directly to clarify their doubts and address pertinent issues. Additionally, the DPO must maintain confidentiality regarding their activities and can perform other functions within the company, provided that there is no conflict of interest.
[3] Under the GDPR, the designation of a DPO is mandatory in three specific cases described in Article 37: (i) when data processing is carried out by a public authority or body, except for courts acting in their judicial capacity; (ii) when the core activities of the controller or processor involve regular and systematic monitoring of data subjects on a large scale; or (iii) when the core activities involve large-scale processing of special categories of data, such as sensitive data or information relating to criminal convictions and offenses.
[4] Article 2, I, of the mentioned resolution defines these agents. Examples include micro-enterprises, small businesses, startups, private legal entities, including non-profit organizations. It is important to note that the agent cannot benefit from the differentiated legal treatment of the resolution if they fall under the scenarios provided in Article 3.
[5] The obligations of small processing agents have been maintained, but a certain flexibility has been introduced in specific areas, such as the doubled timeframe to respond to data subjects’ requests and to communicate with the National Data Protection Authority (ANPD), as well as the possibility of adopting simplified procedures.
[6] The original text of the LGPD stipulated that the DPO must be a natural person. However, Provisional Measure No. 869/2018 removed the term “natural person,” and Law No. 13.853/2019 introduced the possibility for companies to act as a DPO.
[7] In accordance with Article 37, §6 of the GDPR, “the DPO may be a staff member of the controller or processor, or perform the duties on the basis of a service contract”
[8] See Article 38 of the GDPR.
[9] More information is available at: www.ecb.europa.eu (accessed on: 30/10/2024).
The Data Protection Officer (DPO), as established by European legislation (General Data Protection Regulation – “GDPR”) and Brazilian legislation (General Data Protection Law – “LGPD”), plays a critical role in ensuring data protection compliance. These laws define specific requirements for DPO appointments, applicable to both data controllers and processors. The DPO acts as a communication channel between data subjects and the public authority responsible for enforcing data protection regulations. Data Protection Officer (“DPO”) pela legislação europeia (Regulamento Geral sobre a Proteção de Dados – “RGPD”), é uma função estabelecida tanto pela legislação brasileira (Lei Geral de Proteção de Dados – “LGPD”) quanto no RGPD. Ambas as leis têm suas próprias exigências para a nomeação de seus DPOs, seja para os controladores de dados ou os processadores. O DPO atua como um canal de comunicação entre os titulares dos dados e a autoridade pública responsável por aplicar as regulamentações de proteção de dados dentro da jurisdição.
Although both legislations require the presence of a DPO, there are key differences that companies must understand to mitigate risks, avoid legal and administrative sanctions, and safeguard their reputations. To clarify these distinctions, we have prepared a comparative table of the LGPD and GDPR requirements. Para esclarecer essas distinções, preparamos um quadro comparativo referente à LGPD e ao RGPD.
Here are the key characteristics of both legislations:
| GDPR | LGPD | |
| Mandatory DPO Appointment | Mandatory for specific cases: for public organizations or entities engaged in large-scale, systematic monitoring or sensitive data processing (Art. 37). | Generally required for all entities, except for small organizations if a communication channel is in place (Resolution CD/ANPD nº 2/2022). |
| Qualifications and Skills | Professional qualifications required, particularly in law and data protection practices (Art. 37). | Qualifications are determined based on expertise relevant to the context, volume, and risks of data processing operations (Resolution CD/ANPD nº 18/2024). |
| Responsibilities | Includes support for impact assessments, cooperation with regulators, and communication with data subjects (Art. 39). | Includes managing complaints, liaising with data subjects and the ANPD, and advising the company, third parties, and employees on best practices in data protection. |
| Outsourcing | Allowed (Art. 39). | Allowed (Art. 5). |
| Publication of Contact Details | Contact details must be published on the company website and shared with the supervisory authority. | Contact details must be published on the company’s website. |
| Conflict of Interest | Safeguards are implemented to ensure independence and avoid conflicts of interest (Art. 38(3) and 38(6)). | Measures are required to mitigate conflicts of interest (Resolution CD/ANPD nº 18/2024). |
| Position in the Organization | The DPO must operate independently, with access to resources and direct reporting to senior management (Art. 38). | Similar requirements for autonomy and access apply, but there is no explicit protection against dismissal (Resolution CD/ANPD nº 18/2024, Art. 10 and 15). |
Key differences between the DPO role in the GDPR and LGPD
Obligation to appoint a DPO
Unlike the GDPR, which establishes specific criteria for the appointment of a DPO, the LGPD takes a more general approach, requiring that the data controller designates a data protection officer. This means that, in general, any public or private organization must designate a DPO. However, an exception is provided in Resolution CD/ANPD nº 2/2022, which exempts small organizations from naming a DPO, as long as they comply with other LGPD obligations. Additionally, paragraph 3 of Article 41 allows the Brazilian National Data Protection Authority (ANPD) to determine cases where appointing a DPO is unnecessary, based on the nature, size, and volume of data processing activities.
Qualifications and skills
The role of the DPO under the LGPD is more flexible, with less stringent requirements compared to the GDPR, especially in terms of necessary qualifications. According to Article 7 of Resolution CD/ANPD nº 18/2024, it is the responsibility of the data controller to define the DPO’s qualifications, considering their knowledge in data protection legislation and the context, volume, and risks of data processing activities. The resolution also states that the DPO must be able to communicate effectively with data subjects and the ANPD. In contrast, the GDPR (Article 37) imposes stricter requirements, such as extensive knowledge of data protection laws and practices, qualifications proportional to the complexities and risks of the data processing activities, and expertise in technical and organizational measures.
Outsourcing the DPO function
Article 12 of Resolution CD/ANPD nº 18/2024, which regulates the DPO role, allows outsourcing of the position to an individual or entity, regardless of whether they are formally part of the organization’s structure. The GDPR also provides similar outsourcing options.
Disclosure of DPO contact information
Under both legislations, the DPO’s contact details must be published on the organization’s website to ensure transparency and accessibility for data subjects and supervisory authorities. According to Article 9 of Resolution CD/ANPD nº 18/2024, the contact details may also be shared through other communication channels if the organization does not have a website. Similarly, the GDPR requires that DPO contact details be shared with relevant authorities.
Conflict of interest
Both the GDPR and LGPD address the issue of conflicts of interest in relation to the DPO’s duties. The GDPR enforces detailed safeguards to preserve the DPO’s independence, prohibiting them from holding positions that may cause conflicts of interest, such as roles that define the aims of data processing. Additionally, the GDPR prevents DPOs from being penalized or dismissed for performing their responsibilities. The LGPD, on the other hand, requires the data controller to implement measures to mitigate conflicts of interest, with the possibility of replacing the DPO when necessary.
These aspects will be analyzed in greater depth in a specific article that will explore cases and legislation related to conflicts of interest in the context of data protection.
Position within the organization
Regarding overlapping roles, the LGPD does not explicitly prohibit a staff member, administrator, or external contractor from acting as a DPO, provided that the function’s independence is preserved. Similarly, under the GDPR, the DPO may perform other roles within the organization, as long as conflicts of interest are avoided. This means that, under European rules, the DPO cannot hold a position that determines the purposes or means of data processing, such as Chief Executive Officer, Chief Operations Officer, or Head of Human Resources.
The DPO role is fundamental in ensuring compliance with privacy regulations. A clear understanding of the applicable laws governing this role is essential for organizations operating in Brazil. Foreign companies entering the Brazilian market should seek local legal counsel to ensure compliance with the LGPD, particularly regarding the appointment and responsibilities of the DPO.
GTLawyers brings extensive expertise to assist businesses in this area. We offer advisory services to support DPOs in their daily responsibilities or act as external DPOs to reduce potential conflicts of interest. Our team ensures that companies not only meet their legal obligations but also implement effective data protection practices, minimizing legal and reputational risks while maintaining the DPO’s independence and impartiality.
Anne Brunschwig – abrunschwig@gtlawyers.com.br
Jessica Ferreira – jferreira@gtlawyers.com.br
The international transfer of personal data continues to be one of the most challenging topics in the global data protection landscape, as the flow of information across borders intensifies. Resolution CD/ANPD No. 19/2024, published by the National Data Protection Authority (ANPD), introduces detailed rules to regulate such transfers in Brazil, aiming to align with international regulations such as the European Union’s General Data Protection Regulation (GDPR) and U.S. legislation like the California Consumer Privacy Act (CCPA) and the recent EU-US Data Privacy Framework.
The new ANPD Resolution No. 19/2024 establishes criteria and mechanisms for international data transfers to comply with Brazil’s General Data Protection Law (LGPD). While it shares similarities with European and American regulations, it also presents unique nuances that shape the data protection landscape in Brazil.
Countries with Adequate Levels of Protection
ANPD Resolution No. 19/2024, like the GDPR in Europe, permits the transfer of data to countries that offer an adequate level of protection. While the European Commission has already recognized countries like Japan and the United Kingdom as adequate, ANPD, despite conducting its own adequacy analysis, has not yet formally recognized any country as adequate. This analysis takes into account factors such as the data protection laws of the receiving country, the effectiveness of regulatory authorities, the respect for data subjects’ rights, among other factors[1].
Given that no country has yet been recognized as offering adequate levels of protection in Brazil, companies wishing to transfer personal data to other countries must use one of the mechanisms provided for in Resolution No. 19/2024, such as Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs).
Standard Contractual Clauses (SCCs)
One of the most common mechanisms for international transfers is the Standard Contractual Clauses (SCCs). The GDPR has already consolidated these clauses as an essential tool to ensure that personal data transfers to countries outside the European Union occur safely. These SCCs specify clear obligations for data exporters and importers, ensuring that data processing practices comply with data protection principles.Similarly, the ANPD has published its own SCCs in Resolution No. 19/2024, which must be incorporated into contracts between controllers or processors in Brazil and their foreign partners. This step aligns Brazil with global practices, providing a standardized path to ensure the compliance of data transfers, regardless of the destination
One of the most important provisions of the Resolution 19 is that the SCCs must be applied without any alteration[1], as established in the Annex to the regulation. This means that companies choosing to use this mechanism cannot modify the content of the clauses unless express authorization is given by the ANPD for specific adaptations. Companies must also be prepared with a fully implemented Data Governance Program to comply with the SCCs.
Binding Corporate Rules (BCRs)
Both the European Union and Brazil, through Resolution No. 19, recognize Binding Corporate Rules (BCRs) as an efficient mechanism for intra-group transfers. Multinational companies that implement BCRs demonstrate a commitment to a uniform level of data protection, applicable to all their subsidiaries, regardless of geographical location.
For a company in Brazil with its headquarters in Europe, the main provisions of the Resolution include the requirement for adoption and approval of the BCRs by the ANPD, ensuring that these rules align with the principles of the LGPD and provide an adequate level of protection for personal data transferred between entities within the same corporate group. BCRs facilitate the safe transfer of data between subsidiaries and branches located in different countries, such as Brazil and Europe, without the need for individual compliance assessments for each transaction.
Additionally, BCRs must ensure that the rights of data subjects, such as access, correction, and deletion, are respected in all group entities, regardless of jurisdiction. Companies must establish clear and transparent mechanisms to meet these requests from data subjects, ensuring data protection throughout the entire process. The rules also outline responsibility and governance in data processing, including the appointment of a Data Protection Officer (DPO) and the creation of robust internal policies for data protection across all units of the company.
The ANPD also plays a supervisory role over BCRs, which may involve audits and requests for additional information to ensure that personal data protection is being properly implemented and monitored in all the company’s international operations.
Additional Contractual Guarantees and Transfer Mechanisms
In addition to SCCs and BCRs, both Resolution No. 19/2024 and the GDPR allow for the use of other contractual guarantees or mechanisms, such as codes of conduct or certifications, as long as these mechanisms offer equivalent protections to the rights ensured by the legislation. ANPD encourages the adoption of documented and auditable practices so that controllers and processors can demonstrate compliance with the LGPD during international data transfers.
Conclusion
Resolution CD/ANPD No. 19/2024 is a significant milestone for data protection in Brazil in the context of international transfers. The regulation seeks to balance global best practices, such as those implemented in the European Union through the GDPR, while addressing the specificities of the Brazilian context.
The Data Team at GT Lawyers is available to follow the developments of Resolution No. 19/2024 and assist companies in all aspects related to international data transfers.
See Article 11 of Resolution No. 19/2024: “The evaluation of the level of protection of personal data in a foreign country or international organization shall take into consideration: I – the general and sectoral regulations in force that impact the protection of personal data in the destination country or international organization; II – the nature of the data; III – the observance of the general principles of personal data protection and the rights of data subjects provided for in Law No. 13.709, of August 14, 2018; IV – the adoption of appropriate security measures to minimize impacts on the civil liberties and fundamental rights of the data subjects; V – the existence of judicial and institutional guarantees to respect personal data protection rights; and VI – other specific circumstances related to the transfer.”.
See Article 16 of Resolution No. 19/2024: “The validity of international data transfers, when based on the adoption of standard contractual clauses, requires the full and unaltered adoption of the text provided in Annex II, through a contractual instrument signed between the exporter and the importer.”.
