---
sourceDocument: Brazil Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/governance-risk-compliance

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Transfer mechanisms

# Transfer mechanisms {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Transfer mechanisms identify the legal safeguard that permits a specific data transfer between locations.
Privacy regulations often restrict the movement of personal data across jurisdictions unless a recognized legal safeguard applies. A transfer mechanism records that safeguard on a data transfer.

Most transfers rely on reusable safeguards such as Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), adequacy decisions, or approved transfer frameworks. Some transfers rely on case-specific exceptions. For
example, an individual may explicitly consent to the transfer, or the transfer may be necessary for legal proceedings. These exceptions are marked Yes under Special exemption.  
{#transfer-mechanisms__table_transfer_mechanisms__entry__3}

| Transfer mechanism | Description | Special exemption |
|-|-|-|
| Adequacy / Equivalence Decision | Formal determination by a competent authority that another country, region, or sector provides a level of personal data protection substantially equivalent to domestic standards, allowing transfers without further authorization. | No |
| Binding Corporate Rules (BCRs) | Internal policies adopted by multinational corporate groups and approved by a data-protection authority, or an equivalent regulator, to permit intra-group personal data transfers under enforceable and consistent privacy protections. | No |
| Code of Conduct or Certification Mechanism | Approved industry codes or certification schemes that demonstrate compliance with data-protection standards. Organizations that adhere to them and offer binding commitments can rely on these as transfer safeguards. | No |
| Contract in Interest of Individual | Permitted exception allowing a transfer when necessary for concluding or performing a contract in the individual's interest between the data controller and another party. | Yes |
| Contract Necessary for Data Subject | Permitted exception allowing a transfer when it is necessary for the performance, or pre-contractual steps, of a contract directly with the individual whose data is transferred. | Yes |
| Explicit Consent | Informed, explicit consent from the individual after being told of potential risks due to the absence of adequate safeguards. | Yes |
| Framework or International Arrangement | Formal agreement or structured framework between jurisdictions, recognizing that participating organizations provide adequate protection for cross-border transfers, such as a bilateral or multilateral transfer framework. | No |
| Legal Claims or Proceedings | Transfer necessary for establishing, exercising, or defending legal claims, including judicial or administrative proceedings. | Yes |
| Public Interest | Transfer required for reasons of significant public interest recognized in law, policy, or regulation. | Yes |
| Public Register | Transfer of information from a register that is legally intended for public access or for persons with legitimate interest, under defined access conditions. | Yes |
| Standard Contractual Clauses (SCCs) | Pre-approved or regulator-endorsed contractual templates that data exporters and importers adopt to ensure appropriate safeguards for cross-border personal data transfers. | No |
| Transfers within Same Regulatory Area | Transfers within jurisdictions or regions governed by the same privacy regime, such as an economic area, trade bloc, or federal system, that are not considered cross-border and therefore, need no additional mechanisms. | No |
| Vital Interests of Individuals | Transfer necessary to protect the life, health, or safety of an individual who can't provide consent. | Yes |
[Table 1. Transfer mechanisms and their descriptions]

{#transfer-mechanisms__table_transfer_mechanisms}
* **[Add a transfer mechanism to a data transfer record](https://www.servicenow.com/docs/K8H54era~LLLOsDKfruV0A)**   
  Assign a transfer mechanism to a data transfer record to document the legal safeguard that permits the transfer of personal data.
* **[Manage transfer mechanisms in the Privacy Workspace](https://www.servicenow.com/docs/_u8jTgTfhomIfQbQ24U31A)**   
  Add or update the existing transfer mechanisms in your Privacy Management application, so that privacy analysts can add them to data transfer records.