European Union: European Data Protection Board adopted opinion on Commission draft implementing decision on adequate protection of personal data by Brazil

On 4 November 2025, the European Data Protection Board (EDPB) adopted Opinion 28/2025 regarding the European Commission draft implementing decision on Brazil’s adequacy. The opinion notes that Brazil’s General Data Protection Law (LGPD), related presidential decrees, and binding regulations issued by the national data protection authority (ANPD) establish requirements, principles, data-subject rights, transfers, oversight, and redress, closely aligned with the General Data Protection Regulation (GDPR) and the case law of the Court of Justice of the European Union (CJEU). The EDPB invited the Commission to clarify certain aspects, including the practice of Data Protection Impact Assessments (DPIAs) for high-risk processing, transparency limits where “commercial and industrial secrecy” applies, and the conditions for onward transfers, such as consent-based transfers and the content of Binding Corporate Rules (BCRs). It also encourages the Commission to continue monitoring developments.