Mutual adequacy between the EU and Brazil: A new era for transatlantic data transfers

On 27 January 2026, the European Commission (EC) and Brazil announced mutual adequacy decisions, thereby allowing personal data to flow between the European Economic Area (EEA) and Brazil without restriction.¹ The decisions offer greater certainty to businesses with cross-border data flows between the EEA and Brazil, eliminating the need for additional international transfer safeguards (such as the EU Standard Contractual Clauses) in respect of such transfers.

The EC's Adequacy Decision

The EC adopted its adequacy decision under Article 45 GDPR,² concluding that Brazil provides a level of personal data protection that is "essentially equivalent" to that provided under EU law (the "EC Decision"). The EC Decision follows an opinion by the European Data Protection Board (4 November 2025)³ and approval from EU Member States,⁴ forming part of a broader detailed assessment of Brazil's legal framework. The EC Decision itself discussed several aspects of Brazil's General Data Protection Law (LGPD)⁵ – including the core definitions, general principles of processing, and role of the Brazilian Data Protection Authority (ANPD)⁶ – before ultimately determining that Brazil meets the essential equivalence standard.

Practical Impact

As a result, organisations may transfer personal data from the EEA to Brazil without implementing other international transfer safeguards under Chapter V GDPR, such as the EU Standard Contractual Clauses. The EC Decision therefore reduces compliance burdens for organisations with cross-border data flows between the EU and Brazil.

Ongoing Oversight

The EC must monitor relevant developments in Brazil on an ongoing basis and review the adequacy decision at least every four years. This periodic review will assess whether Brazil continues to provide an "essentially equivalent" level of protection for personal data.

Brazil's Adequacy Decision: Resolution CD/ANPD No.32/2026

Brazil has adopted a corresponding adequacy decision, recognising that the EU provides a level of personal data protection compatible with the LGPD, in accordance with the mechanism set out in Article 33 of the LGPD. The ANPD formalised this recognition through Resolution CD/ANPD No. 32/2026, adopted on 27 January 2026 (the "Resolution"). Similar to the EC Decision, the Brazilian adequacy decision will be subject to review within four years from the entry into force of the Resolution.

According to the ANPD's press release, the adequacy decision offers several key benefits for various stakeholders:

• High Standards of Protection – personal data transfers from Brazil to the EU will be subject to the same high standards of protection as those afforded to EU citizens, including strict legal safeguards, effective supervision and redress mechanisms.
• Reduced Administrative Burden – Businesses will benefit from reduced administrative burdens and costs, enhancing competitiveness and facilitating cross-border business. This development facilitates the establishment of commercial partnerships and investments. It also enables simplification for multinational groups, which may standardise internal processes, policies, and contractual arrangements across jurisdictions.
• Support for Innovation – the mutual adequacy decisions should foster innovation and economic growth, strengthening cooperation in emerging industries such as artificial intelligence and data science, and by enabling data-driven business models whose development and deployment depend on stable international data flows (such as those required for machine learning).

It is important to note that the Resolution is subject to certain limitations.

Practical Implications for Businesses

The mutual adequacy decisions materially simplify international data transfers between the EEA and Brazil. Businesses with EEA-Brazil data flows should: (a) assess how the adequacy framework affects their current arrangements and consider streamlining existing safeguards; and (b) continue to monitor developments.

Emily Digby (Trainee Solicitor, White & Case, London), Ciro Torres Freitas (Partner, Piheiro Neto, Brazil) and Laura Bottega Eskudlark (Associate, Piheiro Neto, Brazil) co-authored this publication.

_{1 The EC adopted its adequacy decision on 26 January 2026 (see here), and Brazil's ANPD adopted Resolution CD/ANPD No.32/2026 on 27 January 2026. Both decisions were publicly announced on 27 January 2026 (see here).
2 Regulation (EU) 2016/679 (the "GDPR").
3 Opinion 28/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by Brazil (see here).
4 Comitology procedure (here).
5 Brazil's General Data Protection Law is the Lei Geral de Proteção de Dados ("LGPD").
6 The Brazilian Data Protection Authority is the Autoridade Nacional de Proteção de Dados ("ANPD"). See for example, the EC Decision, Sections 2.3.2 (Definition of personal data), 2.3.3 (The definition of processing), 2.4.1 (Lawfulness and fairness of processing), and 2.5.1 (Independent oversight).}

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2026 White & Case LLP}