The EU Commission adopted an adequacy decision for Brazil in its implementing decision of 26 January 2026. This means that personal data can now be transferred from the EU to recipients in Brazil without additional safeguards (such as standard contractual clauses), provided that they are subject to the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados, LGPD).
What does this mean for you?
- Simplified data transfers: No additional contractual clauses or guarantees are necessary if, for example, you work with Brazilian partners, subsidiaries or cloud providers.
- Verification obligation remains: Ensure that the recipient is actually subject to the LGPD (e.g. through self-disclosure).
- Documentation: Record the adequacy decision in your data transfer documentation (e.g. in the record of processing activities).