backOn January 27, 2026, Brazil and the European Union formalized the reciprocal recognition of the adequacy of their respective personal data protection regimes, pursuant to the Brazilian General Data Protection Law LGPD and the General Data Protection Regulation GDPR. With this decision, both jurisdictions acknowledge that their legal frameworks provide equivalent levels of protection for personal data, establishing a legal environment that enables the free and streamlined international transfer of personal data between the regions, thereby eliminating the need, in such cases, to adopt standard contractual clauses.
As a result of the adequacy decision, transfers of personal data from Brazil to the European Union and from the European Union to Brazil are now free and no longer require the implementation of additional contractual or institutional safeguards, such as standard contractual clauses or binding corporate rules. This represents a significant development in the international data transfer framework, removing regulatory barriers that previously required complex, costly compliance structures to enable cross-border data flows.
The effects of adequacy recognition are substantial for individuals, businesses, and the digital economy. For data subjects, it ensures that personal data transferred between the two jurisdictions remains subject to high standards of protection, with equivalent rights and effective oversight and enforcement mechanisms. For public and private organizations, the decision reduces compliance costs, enhances regulatory predictability, and expands access to the European market, supporting digital operations, investments, and cross-border projects. At an institutional level, the recognition positions Brazil as a jurisdiction aligned with international best practices in personal data protection and strengthens its integration into global value chains and data-driven innovation initiatives. Learn more.
share
