The European Commission is adding to its list of adequacy partners after finalizing a decision with Brazil 27 Jan. The decision recognizes Brazil's data protection framework, the General Data Protection Law, as having equivalent or adequate protections compared to the EU General Data Protection Regulation, allowing data to flow freely between jurisdictions.
The decision is a component of a broader free trade partnership the EU agreed to with Brazil and other Latin American countries. In line with procedures for its other 16 adequacy decisions, the Commission will conduct a review of the agreement every four years.
"Brazil has built a strong privacy and data protection framework that safeguards fundamental rights. Together, we have created the world's largest area for safe, cross-border data flows, covering over 670 million people," European Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection Michael McGrath said in a statement. "This agreement boosts digital trade, supports businesses of all sizes, and sets a global benchmark showing that strong privacy protections can coexist with innovation and growth. It sends a clear message: fundamental rights don't stop at borders, giving consumers confidence that their data is respected and protected."
Before finalization, the decision received supporting opinions from the European Data Protection Board and the Council of the European Union. In its November 2025 opinion, the EDPB noted Brazil's LGPD closely aligns with EU legislation and case law set by the Court of Justice of the European Union. The board also sought some clarifications around specific areas of adequacy, including LGPD provisions for data protection impact assessments.
"The EDPB welcomes the alignment between Brazil and Europe's data protection frameworks," EDPB Chair Anu Talus said in November. "This is a pivotal moment that will strengthen legal certainty for organisations and competent authorities transferring personal data from Europe to Brazil."
The agreement had been in the works over recent years, with former European Commissioner for Justice Didier Reynders acknowledging negotiations during a keynote address at the IAPP Europe Congress 2023.
The Commission has been busy on the adequacy front in the last 12 months. EU-U.K. adequacy was renewed in December 2025 after the Commission reviewed U.K. data protection reforms under the Data (Use and Access) Act. In July 2025, the Commission granted adequacy to the European Patent Office, marking the first decision covering an international nongovernmental organization.
For Brazil, the adequacy agreement and data free flow represent growth opportunities. Brazil's data protection agency, the Agência Nacional de Proteção de Dados, noted the decision "should boost cooperation in areas such as scientific research, health, artificial intelligence, data science, and emerging technologies."
"Now, the sending of personal data to Europe — and from Europe to Brazil — can be done more directly and simply. This reduces costs, increases legal certainty, and strengthens digital commerce between the two regions," ANPD CEO Waldemar Gonçalves said in a statement.
The ANPD scheduled a 28 Jan. webinar to unpack the implications of the new agreement on businesses, the public sector and consumers.
Joe Duball is the news editor for the IAPP.
