European Union publishes draft Adequacy Decision concerning Brazil: if adopted, personal data may flow without further authorizations

European Union publishes draft Adequacy Decision concerning Brazil: if adopted, personal data may flow without further authorizations

On September 5, 2025, the European Commission published the draft adequacy decision recognizing Brazil as a country that ensures a level of personal data protection equivalent to that of European Union (EU) legislation. This measure, if formally adopted, will facilitate the transfer of personal data between the EU and Brazil, simplifying the flow of information for corporate entities and organizations.

Transfers of personal data from the European Union to countries not within the bloc, referred to as “third countries,” may proceed pursuant to an adequacy decision, as stipulated in Article 45 of Regulation (EU) 2016/679, known as the General Data Protection Regulation (GDPR), or by means of appropriate safeguards and supplementary mechanisms, in accordance with Articles 46 to 49 of the aforementioned regulatory text. An adequacy decision requires the European Commission to assess, considering the criteria set forth in Article 45(2), whether the country offers an essentially equivalent level of protection to the European standard, considering aspects such as the rule of law, respect for human rights, the existence of an independent supervisory authority, and the rules governing public authorities’ access to data. Should a country be recognized as “adequate,” as would be the case for Brazil if the decision is approved, data may be transferred without the requirement for additional authorizations, in a manner equivalent to transfers executed within the EU itself.

In the case of Brazil, the analysis underscored the enshrinement of data protection as a fundamental right within the Federal Constitution, alongside the country’s accession to the American Convention on Human Rights and its recognition of the jurisdiction of the Inter-American Court of Human Rights, which collectively expand the judicial and international protection of fundamental rights. The analysis further examined the General Data Protection Law (LGPD), effective since 2018, and the performance of the National Data Protection Authority (ANPD), established in 2019 and subsequently transformed into an independent administrative authority in 2022, vested with the competence to regulate, supervise, and apply sanctions. The Commission ultimately concluded that the Brazilian legal framework ensures that any interferences by public authorities, particularly for the purposes of criminal law enforcement or national security, respect the limits of necessity and proportionality, with effective legal safeguards against abuses.

Based on these elements, the preliminary document concludes that Brazil ensures an adequate level of data protection and mandates a continuous monitoring mechanism, with a review scheduled for four years subsequent to the decision’s entry into force. For the proposal to be formally adopted, it remains contingent upon a positive opinion from the committee of EU Member States’ representatives, pursuant to Article 93 of the GDPR and Article 5 of Regulation (EU) 182/2011. Only after securing this endorsement may the Commission proceed to adopt the final decision.

Within Brazil, the adequacy decision is also provided for within its domestic legal framework. Resolution CD/ANPD No. 19 of August 23, 2024, establishes rules applicable to the international transfer of personal data and stipulates that the ANPD may recognize, by means of an adequacy decision, the equivalence of the level of data protection in foreign countries or international organizations with the national legislation, as per Article 10 of Chapter IV. To date, no adequacy decision has been issued by the ANPD’s Board of Directors, according to information available on authority’s official website.

The draft EU Adequacy Decision with Brazil may be accessed at the following link: Draft Adequacy Decision with Brazil | European Commission

The GDPR can be accessed via the link: Regulation – 2016/679 – EN – gdpr – EUR-Lex

Regulation (EU) 182/2011 can be accessed via the link: Regulation – 182/2011 – EN – EUR-Lex

Resolution CD/ANPD No. 19 of 23 August 2024 is available at:  Resolução CD/ANPD nº 19, de 23 de agosto de 2024 — Agência Nacional de Proteção de Dados

Note: For quick release, this English version is provided by automated translation without human review.