Brazil: National Data Protection Authority declined adequacy decision on data sharing between Ministry of Development and World Bank

On 13 February 2025, the Brazilian Data Protection Authority (ANPD) denied a request to initiate an adequacy decision for the World Bank – International Bank for Reconstruction and Development (IBRD). The ruling confirms that adequacy decisions require a formal evaluation of the recipient’s data protection regime to ensure alignment with Brazil’s General Data Protection Law. It highlights that priority is given to jurisdictions that provide reciprocal recognition of Brazil’s framework, which the World Bank does not. It also clarifies that adequacy decisions apply broadly rather than to specific data-sharing agreements and that alternative transfer mechanisms, such as standard contractual clauses, should be used instead.