ANPD publishes first adequacy decision for the European Union, which likewise recognizes Brazil’s adequate level of data protection

On January 27, 2026, the Brazilian National Data Protection Agency (“ANPD”) published Resolution No. 32, its first adequacy decision, which recognizes the European Union as an international organization that provides a level of personal data protection adequate to that set forth under the Brazilian General Data Protection Law (“LGPD”), pursuant to article 33, item I, of the LGPD.

Reciprocally, on January 26, 2026, the European Commission issued an adequacy decision recognizing that Brazil, under the LGPD, ensures an adequate level of protection for personal data transferred from the European Union to the country. As a result, Brazil joins the list of 17 countries and international organizations recognized as adequate by the European Commission.

In practical terms, such decisions simplify international transfers of personal data between Brazil and all Member States of the European Union, the countries that comprise the European Economic Area, and institutions, bodies, and agencies of the European Union. Accordingly, the adoption of other international data transfer mechanisms, such as standard contractual clauses and binding corporate rules, is no longer required, both for transfers from Brazil to the European Union and in the opposite direction.

It is important to note that the entry into force of Resolution No. 32 does not invalidate the international data transfer mechanisms already adopted by data processing agents, and there is no need to amend contractual instruments currently in force.

Should you have any questions regarding the matter above, please do not hesitate to contact us.