Compliance · EU → BR
The EU and Brazil now recognise each other's data laws — what adequacy actually removes
Jul 17, 2026 · 6 min read
In short
In late January 2026 Brazil and the EU recognised each other's data protection regimes as adequate: ANPD Resolution CD/ANPD No. 32 was published on 26 January and took effect immediately, and the European Commission adopted its adequacy decision for Brazil on 27 January, making Brazil the seventeenth jurisdiction with EU adequacy. In practice, personal data can now flow between Brazil and the EEA without standard contractual clauses or other additional transfer mechanisms — EU exporters rely on GDPR Article 45 rather than SCCs, and Brazilian exporters rely on LGPD Article 33(I). The decision does not cover transfers made solely for public security, national defence, state security, or criminal investigation and prosecution, and it does not remove any substantive obligation: a lawful basis, a DPO, processing agreements, transparency, security and breach handling all still apply. It is reviewed on a four-year cycle and can be reopened earlier if either regime changes materially.
Standard contractual clauses are no longer the price of moving personal data between Brazil and Europe. In late January 2026 the two jurisdictions recognised each other's regimes as adequate — ANPD Resolution CD/ANPD No. 32 was published on 26 January and came into force on publication, and the European Commission adopted its own adequacy decision for Brazil on 27 January. Data can now move in both directions on the strength of the decisions themselves. For an EU company running a Brazilian subsidiary, a distributor portal or a customer database split across the corridor, the transfer-mechanism question that used to sit in every vendor contract has largely gone quiet.
What that removes is specific. An EU exporter sending personal data to Brazil relies on Article 45 of the GDPR instead of negotiating SCCs; a Brazilian exporter sending data to Europe relies on Article 33(I) of the LGPD instead of adopting the ANPD's standard clauses, which only became mandatory for existing contracts in August 2025. The Brazilian decision covers the EU Member States, the EEA countries — Iceland, Liechtenstein and Norway — and the EU institutions. It is the first time the Commission has agreed a mutual arrangement of this scope, covering the public and private sectors at once and all categories of data, sensitive data included. In procurement terms, it takes a negotiation out of vendor onboarding.
It is worth being precise about what has not changed, because the decision is an institutional bridge rather than a compliance seal. Adequacy governs the transfer, not the processing: you still need a lawful basis, transparency to data subjects, a data protection officer where one is required, processing agreements with your vendors, security measures and a working incident process. Both regimes apply in full on either side of the bridge. The decision also carves out transfers made exclusively for public security, national defence, state security, or criminal investigation and prosecution — those still need their own footing.
The durability question is the one worth planning around. The EDPB's Opinion 28/2025 of 5 November 2025 was supportive but asked the Commission to keep watching several points: how Brazil handles data protection impact assessments, limits on transparency where commercial and industrial secrecy is invoked, the rules on onward transfers out of Brazil, how Brazilian law reaches law enforcement activity, and the scope of Brazil's concept of national security. The decision is reassessed within four years and can be reopened sooner if either regime shifts. Anyone who watched Safe Harbour and Privacy Shield will draw the obvious conclusion: treat adequacy as the default, keep your data flows mapped, and keep SCCs as a fallback you could execute rather than one you have to invent under time pressure.
The commercial read is modest but real. Adequacy does not open a market, and it will not decide whether Brazil is worth entering. What it does is remove a recurring friction — the contract annex, the transfer impact assessment, the legal review that added weeks to every integration — from a corridor where that friction was rarely the interesting part of the deal. The obstacles that actually govern an entry are still the product ones: who holds the registration, who imports of record, and what the landed cost does to your price. If you are weighing the Brazilian corridor, our Opportunity Scan is the place to start on those.
Business intelligence, not legal or tax advice.