Data Protection | International Data Transfers
Brazil and Europe Mutually Recognize Adequacy: Practical Impacts for Companies
In this week in which we celebrate International Data Protection Day, Brazil and Europe have made decisive progress regarding international transfers of personal data.
The European Commission has recognized Brazil as a country providing an adequate level of data protection, while the Brazilian Data Protection Authority (ANPD), through Resolution No. 32/2026, has recognized as adequate all European Union Member States, as well as the EFTA countries that are part of the EEA: Iceland, Liechtenstein, and Norway.
Main practical impact
As a general rule, international transfers of personal data between Brazil and these jurisdictions no longer require additional transfer mechanisms, such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs), pursuant to Article 33(I) of the Brazilian General Data Protection Law (LGPD).
This development reduces costs, simplifies contractual structures, and enhances legal certainty for international operations.
Important points to note
• The LGPD remains fully applicable, including requirements related to legal bases, data protection principles, security measures, data subject rights, and governance.
• The adequacy recognition does not apply to transfers carried out for purposes of public security, national defense, or criminal law enforcement.
• The adequacy decisions provide for ongoing monitoring and periodic reassessment of the level of protection.
Our recommendations
• Review international data flows involving the EU and EEA/EFTA countries;
• Reassess contracts that currently rely on SCCs;
• Update internal policies and records of processing activities;
• Maintain robust compliance and information security controls.
Our team closely monitors regulatory developments and remains available to support clients with the practical assessment of impacts and the alignment of international data transfer frameworks.