#
A full transfer-mechanism toolkit is now operative and the landmark 2026 mutual adequacy determination substantially de-risks EU-Brazil data flows, though SCC/BCR implementation details remain partly unresolved.
Sub-modules (6)
Transfer MechanismsGreen
Article 33 lists exhaustive grounds for international transfers: adequacy, contractual/BCR guarantees, international cooperation agreements, life/safety protection, ANPD prior authorization, public-policy execution, consent, legal/regulatory compliance, contractual necessity, and exercise of rights.
Claims (1):
- Article 33 of the LGPD provides an exhaustive list of grounds authorising international data transfers, including adequacy, contractual instruments, ANPD-authorised specific clauses, international cooperation agreements, and data-subject consent.
Adequacy ReceivedGreen
The European Commission's Implementing Decision 2026/179 (January 2026) recognises that Brazil ensures an adequate level of protection for personal data transferred from the EU under GDPR Article 45.
Claims (1):
- For the purpose of Article 45 of Regulation (EU) 2016/679, Brazil ensures an adequate level of protection for personal data transferred from the European Union to controllers and processors in Brazil subject to the LGPD.
Adequacy GrantedGreen
ANPD's Resolution No. 32/2026 reciprocally recognised the EU as an international organisation providing an adequate level of protection for international transfers under the LGPD.
Claims (1):
- In Resolution No. 32/2026, ANPD recognized the EU as an international organization providing an adequate level of protection for purposes of international data transfers under the LGPD.
Sccs And BcrsAmber
ANPD introduced a rigid standard-contractual-clause model (inspired by EU, UK, New Zealand and Singapore frameworks) divided into general information, mandatory clauses, security measures, and additional clauses/annexes; BCRs require prior ANPD assessment and evidence of a data-privacy governance program.
Claims (2):
- ANPD's SCCs can form a stand-alone contract or be attached to a broader agreement, are divided into general information, mandatory clauses, security measures, and additional clauses/annexes, and unlike EU clauses do not feature modules but customizable fields.
- Use of BCRs for intragroup international transfers requires prior ANPD assessment, with data controllers demonstrating compliance including implementation of a data privacy governance program.
Transfer Impact AssessmentAmber
The LGPD does not impose a discrete, Schrems-II-style per-transfer impact assessment; adequacy equivalence is instead assessed by ANPD at the country level, though commentators note open questions about whether additional safeguards for SCCs may eventually be required.
Claims (1):
- There will inevitably be discussions about the adequacy of SCCs and whether additional measures are necessary, mirroring concerns raised in the EU under Schrems II.
Data LocalisationAmber
Brazil does not impose a general data-localisation mandate; however, discussions of a 'sovereign cloud' as part of Brazil's Artificial Intelligence Plan aim to keep government data stored within national borders.
Claims (1):
- Publication of the ANPD international-transfer regulation coincided with discussions of creating a 'sovereign cloud' under Brazil's Artificial Intelligence Plan, aiming to keep government data stored within national borders.
Cross-Border & Adequacy
Brazil received its first-ever adequacy decision this cycle. Following reciprocal decisions adopted 26 to 27 January 2026, personal data may flow between Brazil and the EU/EEA, including Iceland, Liechtenstein and Norway, without additional transfer safeguards such as Standard Contractual Clauses or Binding Corporate Rules. This is a confirmed, high-materiality development affecting the transfer mechanism landscape in both directions.
On the EU side, the European Commission adopted its adequacy decision on 26 January 2026 under GDPR Article 45, finding Brazil's LGPD-based framework essentially equivalent to EU data protection, and permitting EU-to-Brazil transfers without additional safeguards. On the Brazilian side, ANPD's Resolução CD/ANPD 32/2026, adopted 26 to 27 January 2026, formally recognises the European Union, covering all Member States plus Iceland, Liechtenstein and Norway, as providing adequate personal-data protection under LGPD Article 33(I). This recognition is subject to review every four years from the adoption date, and carries an explicit carve-out preserving the need for additional safeguards on transfers related to public security, national defence, or criminal investigation.
This reciprocal pairing of decisions is a structural, not episodic, development: it establishes for the first time a bilateral adequacy relationship that eliminates the routine transfer-mechanism burden for the large volume of EU-Brazil personal-data flows, while preserving a defined and narrow carve-out for security-sensitive categories.
Outlook
The adequacy decisions are due for review every four years from the January 2026 adoption date, placing the first formal review point in 2030. In the nearer term, watch for any sector-specific guidance clarifying how the public-security and criminal-investigation carve-out will be applied in practice.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and claims (7)
- ConfirmedIAPP — Article 33 of the LGPD provides an exhaustive list of grounds authorising international data transfers, including adequacy, contractual instruments, ANPD-authorised specific clauses, international cooperation agreements, and data-subject consent.observed
- ConfirmedEUR-Lex — For the purpose of Article 45 of Regulation (EU) 2016/679, Brazil ensures an adequate level of protection for personal data transferred from the European Union to controllers and processors in Brazil subject to the LGPD.observed
- ConfirmedIAPP — In Resolution No. 32/2026, ANPD recognized the EU as an international organization providing an adequate level of protection for purposes of international data transfers under the LGPD.observed
- ConfirmedIAPP — ANPD's SCCs can form a stand-alone contract or be attached to a broader agreement, are divided into general information, mandatory clauses, security measures, and additional clauses/annexes, and unlike EU clauses do not feature modules but customizable fields.observed
- ConfirmedIAPP — Use of BCRs for intragroup international transfers requires prior ANPD assessment, with data controllers demonstrating compliance including implementation of a data privacy governance program.observed
- UncertainIAPP — There will inevitably be discussions about the adequacy of SCCs and whether additional measures are necessary, mirroring concerns raised in the EU under Schrems II.observed
- UncertainIAPP — Publication of the ANPD international-transfer regulation coincided with discussions of creating a 'sovereign cloud' under Brazil's Artificial Intelligence Plan, aiming to keep government data stored within national borders.observed