On 26 and 27 January 2026, the European Commission and Brazil adopted corresponding adequacy decisions, respectively, allowing personal data to be transferred between Brazil and the EU for business, administrative and research purposes without additional safeguards. These decisions followed the launch of the EU adequacy procedure in September 2025 and the subsequent green light European Data Protection Board for the Commission’s draft decision. The Board highlighted the close alignment of Brazil’s data protection framework with the General Data Protection Regulation (GDPR).

Pursuant to Art. 45(3) GDPR, the Commission recognised that Brazil ensures a level of data protection essentially equivalent to that guaranteed within the EU. The decision builds on the substantial development of Brazil’s data protection framework, particularly the adoption of the General Data Protection Law (Lei Geral de Proteção de Dados, LGPD) in 2018 and the subsequent establishment of an independent national data protection authority.

In a joint press statement, Michael McGrath (Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection), and Waldemar Gonçalves Ortunho Júnior (President of the Brazilian Data Protection Authority) emphasised the benefits of these decisions for citizens, businesses and public authorities. By enabling personal data to flow in both directions without the need for additional safeguards or prior authorisations, the new framework is expected to boost digital trade, reduce compliance costs and enhance legal certainty. The decisions thereby create the world’s largest area of free and safe data flows, encompassing approximately 670 million consumers.

The mutual adequacy decisions also complement the EU-Mercosur Partnership Agreement and the Interim Trade Agreement, both of which were signed on 17 January 2026. While the agreements seek to deepen political and economic ties and facilitate cross-border trade, the adequacy decisions reinforce these efforts by removing data protection-related barriers to personal data transfers between the EU and Brazil.

Notably, from a criminal justice perspective, the Brazilian adequacy decision expressly excludes transfers carried out exclusively for public security and law enforcement purposes. Therefore, the mutual adequacy decisions do not provide a legal basis for the direct exchange of operational data between law enforcement authorities. Such cooperation is governed separately, in particular by the EU-Brazil agreement on cooperation with and through Europol. This agreement enables the exchange of personal and non-personal data for law enforcement purposes and was signed in March 2025 and formally concluded in September 2025 (→ eucrim 1/2025, 15).

Both sides will continuously monitor developments in the other party’s data protection framework and conduct an initial review within four years. If either framework ceases to ensure an adequate level of protection, the corresponding adequacy decision may be suspended, amended or repealed.