European Union: European Commission launched procedure on adequacy decision for personal data transfers with Brazil

On 5 September 2025, the European Commission launched the procedure towards the adoption of an adequacy decision with the Federative Republic of Brazil, determining that Brazil ensures an adequate level of protection for personal data that is essentially equivalent to the General Data Protection Regulation (GDPR). The draft decision, based on an assessment of Brazil’s constitutional guarantees, the General Data Protection Law (LGPD) of 2018, subsequent amendments, the establishment of the National Data Protection Authority (ANPD), and Brazil’s adherence to the American Convention on Human Rights, will permit transfers of personal data from controllers and processors in the Union to controllers and processors in Brazil without further authorisation. Once adopted, the decision will cover a wide scope of data flows for businesses, public authorities, and research projects, subject to periodic reviews by the Commission together with European data protection authorities and complemented by Brazil’s reciprocal process to establish an adequacy decision allowing personal data to flow freely from Brazil to the Union.