On January 27th, 2026, the European Union"s adequacy decision for Brazil was published, pursuant to article 45 of the General Data Protection Regulation (GDPR), recognizing that Brazil ensures a level of protection of personal data essentially equivalent to the European one. Reciprocally, Brazil published the decision on Brazil"s adequacy for the European Union, pursuant to the General Data Protection Law (LGPD, in the Portuguese acronym) and Resolution CD/ANPD No. 19/2024.
Why this matters
The adequacy decisions allow for the international transfer of personal data between the European Union and Brazil without the need for additional mechanisms such as standard contractual clauses or other safeguards provided for non-adequate countries. This reduces regulatory complexity, operational costs, and legal risks for organizations that carry out data flows between these territories.
What changes in practice
- Transfers of personal data from the EU to Brazil and from Brazil to the EU are now carried out on the basis of the adequacy decision.
- It is no longer necessary to adopt specific transfer mechanisms only for these bilateral flows.
What processing agents should do
Despite the regulatory advance, it is important to highlight that:
- Nothing changes for international transfers involving other countries or territories that are not covered by adequacy decisions. For such cases, processing agents must continue to regularize international transfers, for example, through standard contractual clauses, binding corporate rules, or other mechanisms provided for in the LGPD and GDPR.
- It is recommended to map international data flows, update processing records, and review internal contracts and policies to reflect the new legal basis applicable to transfers between the EU and Brazil.
- Controllers must update the information made available on their websites, publishing a document in Portuguese, in simple, clear and accessible language, with the minimum content described in the Resolution.
Where to find additional information
The Brazilian Data Protection Agency (ANPD) provides additional information on the subject on its institutional website (here).
TozziniFreire is available to discuss the topic and provide any necessary assistance related to adequacy decisions and international data transfers.
