Brazil: Resolution No. 32 recognising European Union as providing an adequate level of personal data protection for international data transfers enters into force

On 27 January 2026, Resolution No. 32 entered into force following its publication in the Official Gazette of the Union. The resolution, adopted by the National Data Protection Agency (ANPD), recognises the European Union as ensuring a level of personal data protection adequate to that provided under the General Personal Data Protection Law (LGPD) (Law No. 13.709 of 14 August 2018) for the purposes of international data transfers. The resolution authorises transfers pursuant to Article 33(I) LGPD to European Union Member States, the European Economic Area, European Free Trade Association States (Iceland, Liechtenstein and Norway), as well as European Union institutions, bodies and agencies. It excludes transfers carried out exclusively for public security, national defence, state security, or criminal investigation and prosecution. The resolution also establishes cooperation mechanisms and provides for continuous monitoring by the ANPD, requires reassessment within four years in light of subsequent legislative developments, and preserves the use of other international data transfer mechanisms available under Article 33 LGPD.