The European Commission has confirmed Brazil provides a GDPR-adequate level of data protection in a decision that is anticipated to benefit the country’s economy.
Brazil is set to become the 17th jurisdiction recognised as providing a level of data protection equivalent to that of the EU following a draft decision from the European Commission.
The European Commission on 5 September published a draft adequacy decision recognising Brazil’s data protection framework, known as the LGPD, as “essentially equivalent” to the EU’s GDPR.
Once adopted, the decision will enable unrestricted data flows between the EU and Brazil without needing extra safeguards such as standard contractual clauses. It will also see Brazil join 16 other jurisdictions already recognised as EU adequate including the UK, Canada, Japan, Korea and Argentina.
Brazil’s data protection authority, the ANPD, is in the process of reviewing the EU’s framework to adopt a reciprocal adequacy decision to allow Brazilian data to flow freely to the EU. The decision follows confirmation from ANPD director Miriam Wimmer to Lexology PRO on 15 July that an adequacy decision was in its “final stages”.
Lahorgue Advogadas partner Simone Lahorgue Nunes said the decision will “bring significant benefits” to Brazil besides the free-flow of data between the country and the EU, including greater legal certainty for companies, reduced compliance costs, and “a more stable business environment between these two regions.”
“In sum, the adequacy decision will serve as an international 'seal of trust,' positioning Brazil as a reliable partner in the global digital economy, strengthening the protection of citizens’ data, and fostering trade, investment, and technological innovation,” Lahorgue Nunes told Lexology PRO.
Montaury partner Cristiane Manzueto said she expects trade relations between Brazil and the EU to deepen following the adequacy decision and the recognition that the LGPD offers protection equivalent to the GDPR will “enhance consumer trust in digital services.”
“Such recognition is particularly beneficial for Brazilian startups and tech companies that rely on cross-border data transfers with Europe, as it promotes innovation and competitiveness,” Manzueto said.
She adds that the decision is likely to “significantly boost Brazil’s global reputation in data protection”, in turn attracting greater foreign investment and partnerships with tech companies.
Now in the adoption procedures final phase, the draft decision will be referred to the European Data Protection Board (EDPB) for its opinion and the commission will seek approval from a committee of member state representatives.
The EDPB opinion plays a “crucial role” in the process and it is anticipated to likely support the draft decision, Manzueto noted. “The EDPB is expected to issue a favourable opinion. However, it may recommend clarifications or monitoring mechanisms to ensure ongoing compliance.”
Commission executive vice-president Henna Virkkunen said the EU and Brazil share “close cultural and economic ties” and the decision will be a vital step in bringing both economies closer.
The commission will continue to monitor Brazil’s application of the LGPD and whether the country ensures a level of protection which remains adequate to the EU and can suspend, repeal, or amend the decision if it finds it to be no longer adequate.
Article written by Rosie Harris-Davison with the contribution of Cristiane Manzueto, published in the platform Lexology.
