On 26 January   2026, the EU- Commission adopted Implementing Decision (EU) 2026/179, recognizing Brazil under Art. 45 GDPR as a third country providing a level of data protection essentially equivalent to that of the EU. This decision is based on Brazil’s General Data Protection Law “Lei Geral de Proteção de Dados” ( LGPD) and its enforcement by the competent Brazilian data protection authority, the ANPD.

The adequacy decision carries significant legal and economic weight. Data exchanges between the EU and Brazil will now be much simpler and enjoy greater legal certainty. At the same time, Brazil itself has confirmed the EU as a reliable data protection partner through Resolution  CD/ANPD No. 32, dated 26 January 2026, creating a shared data space for several hundred million individuals.

1. What is an adequacy decision and why is it important?

An adequacy decision under Art. 45 GDPR is the core mechanism for international data transfers. It confirms that a third country has an adequate level of data protection, equivalent to that of the EU. As a result, personal data can be transferred to that country without the need for additional guarantees such as standard contractual clauses or binding corporate rules.

With the adequacy decision in place, additional guarantees for data transfers between the EU and Brazil are no longer required: data can be transferred directly as long as they comply with data protection requirements.

2. Significance for data transfers between the EU and Brazil

Brazil is the largest country in Latin America and a key economic partner of the EU. The adequacy decision creates a uniform and reliable framework for companies in both regions. Specifically, this means:

• Companies can transfer personal data to Brazil without additional guarantees, provided that the recipients are subject to the LGPD. This simplifies business processes;
• Clear guidelines and comparable data protection standards create legal certainty and facilitate the planning of international projects;
• Regular reviews by the data protection authorities on both sides ensure a consistently high level of data protection and increase legal certainty for companies.

3. Regular review and outlook

Despite the simplifications, the adequacy decision is not permanent. It will be subject to a formal review every four years, during which the EU Commission will work closely with the Brazilian authorities, in particular the ANPD. The review will focus on areas such as access to data by public authorities, transparency, and further transfers to third countries.

4. Guidance for Companies

Although the adequacy decision facilitates data transfers to Brazil, it does not replace the other data protection obligations of companies. In addition, companies that process personal data between the EU and Brazil should now implement the following measures:

• Review existing contracts with Brazilian business partners and, if necessary, switch from standard contractual clauses to references to Article 45 GDPR;
• Update internal compliance guidelines, data protection documentation, and privacy policies to correctly reflect the new legal situation;
• Continuously monitor developments in Brazilian data protection practice and possible adjustments to the adequacy decision.

We are happy to assist you in reviewing your data transfer structures, updating relevant contracts, and strategically planning your international data protection compliance with regard to the new adequacy decision for Brazil.