European Union: Commission implementing decision on the adequate level of protection of personal data by Brazil enters into force

On 28 January 2026, the European Commission’s implementing decision recognising that Brazil ensures an adequate level of protection for personal data under the EU General Data Protection Regulation (GDPR) enters into force. The decision confirms that Brazil provides comparable levels of data protection, allowing personal data to be transferred freely between the two jurisdictions without additional authorisations or safeguards. In reaching its decision, the Commission assessed Brazil’s Law No. 13.709/2018, the independence and enforcement powers of the National Data Protection Authority (ANPD), and the safeguards governing public authorities’ access to personal data for law enforcement and national security purposes. The Commission will monitor the functioning of the adequacy decision and review it after four years.