EU moves to recognise Brazil’s data protection system as ‘adequate’

The European Commission has published a draft decision saying that Brazil provides a level of data protection essentially equivalent to that found in the European Union. This means that personal data can flow freely between the EU and Brazil without companies needing special authorisations or extra safeguards. The decision is based on a detailed review of Brazil’s privacy and data protection framework, especially its General Data Protection Law, known as the LGPD.

Brazil’s Constitution recognises privacy and data protection as fundamental rights, and the LGPD, adopted in 2018, sets rules very similar to the EU’s General Data Protection Regulation (GDPR). It defines what counts as personal data, lays out when data can be processed, and includes strong safeguards for sensitive information such as health or biometric data. Importantly, Brazil has also created an independent data protection authority, the ANPD, which enforces the law and can issue fines or corrective measures.

The European Commission concluded that Brazil’s system offers strong rights for individuals, including the right to be informed, the right to access data, the right to correct mistakes, and the right to delete personal information. There are also clear limits on how long data can be stored and strict rules on security and breach notification. Public authorities in Brazil, including law enforcement, are subject to safeguards and oversight when accessing personal data. As a result, the Commission believes that EU citizens’ data will remain well protected when transferred to Brazil.

If adopted, this adequacy decision would strengthen trade and cooperation between the EU and Brazil by making cross-border data flows easier and legally safer. It would also mark an important step in aligning Brazil more closely with global data protection standards.