--- title: "Brazil — Cross-Border & Adequacy | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/brazil/cross-border-and-adequacy/ source_html: /jurisdictions/brazil/cross-border-and-adequacy/index.html description: "Brazil — Cross-Border & Adequacy: cross_border_and_adequacy Cross-Border & Adequacy 6 sub-modules 7 claims Green ▾ # A full transfer-mechanism toolkit is now operative and the landmark 2026 mutual adequacy determin" generated_at: 2026-10-25T04:46:50Z content_sha256: 27e7050ff9b2f1f0e6d80d249971063f018dd88d43a991980d3c44647e8533a3 generator: "fe-fleet/md-twin@1.0" --- # Brazil — Cross-Border & Adequacy | Data Protection Monitor ### D5Cross-Border & Adequacy6 sub-modules7 claimsGreen▾# A full transfer-mechanism toolkit is now operative and the landmark 2026 mutual adequacy determination substantially de-risks EU-Brazil data flows, though SCC/BCR implementation details remain partly unresolved. Primary framework LGPD Arts. 33–36; ANPD International Data Transfer Regulation (Aug. 2024); Resolution No. 32/2026 Supervisory authority [Agência Nacional de Proteção de Dados (ANPD)](https://www.gov.br/anpd/) Traffic-light rationale — Green A full transfer-mechanism toolkit is now operative and the landmark 2026 mutual adequacy determination substantially de-risks EU-Brazil data flows, though SCC/BCR implementation details remain partly unresolved. #### Sub-modules (6) #### Transfer MechanismsGreen Article 33 lists exhaustive grounds for international transfers: adequacy, contractual/BCR guarantees, international cooperation agreements, life/safety protection, ANPD prior authorization, public-policy execution, consent, legal/regulatory compliance, contractual necessity, and exercise of rights. Claims (1): - Article 33 of the LGPD provides an exhaustive list of grounds authorising international data transfers, including adequacy, contractual instruments, ANPD-authorised specific clauses, international cooperation agreements, and data-subject consent. #### Adequacy ReceivedGreen The European Commission's Implementing Decision 2026/179 (January 2026) recognises that Brazil ensures an adequate level of protection for personal data transferred from the EU under GDPR Article 45. Claims (1): - For the purpose of Article 45 of Regulation (EU) 2016/679, Brazil ensures an adequate level of protection for personal data transferred from the European Union to controllers and processors in Brazil subject to the LGPD. #### Adequacy GrantedGreen ANPD's Resolution No. 32/2026 reciprocally recognised the EU as an international organisation providing an adequate level of protection for international transfers under the LGPD. Claims (1): - In Resolution No. 32/2026, ANPD recognized the EU as an international organization providing an adequate level of protection for purposes of international data transfers under the LGPD. #### Sccs And BcrsAmber ANPD introduced a rigid standard-contractual-clause model (inspired by EU, UK, New Zealand and Singapore frameworks) divided into general information, mandatory clauses, security measures, and additional clauses/annexes; BCRs require prior ANPD assessment and evidence of a data-privacy governance program. Claims (2): - ANPD's SCCs can form a stand-alone contract or be attached to a broader agreement, are divided into general information, mandatory clauses, security measures, and additional clauses/annexes, and unlike EU clauses do not feature modules but customizable fields. - Use of BCRs for intragroup international transfers requires prior ANPD assessment, with data controllers demonstrating compliance including implementation of a data privacy governance program. #### Transfer Impact AssessmentAmber The LGPD does not impose a discrete, Schrems-II-style per-transfer impact assessment; adequacy equivalence is instead assessed by ANPD at the country level, though commentators note open questions about whether additional safeguards for SCCs may eventually be required. Claims (1): - There will inevitably be discussions about the adequacy of SCCs and whether additional measures are necessary, mirroring concerns raised in the EU under Schrems II. #### Data LocalisationAmber Brazil does not impose a general data-localisation mandate; however, discussions of a 'sovereign cloud' as part of Brazil's Artificial Intelligence Plan aim to keep government data stored within national borders. Claims (1): - Publication of the ANPD international-transfer regulation coincided with discussions of creating a 'sovereign cloud' under Brazil's Artificial Intelligence Plan, aiming to keep government data stored within national borders. Category narrative 72 words Article 33 provides an exhaustive list of transfer mechanisms (adequacy, standard contractual clauses, BCRs, consent, legal-obligation, contract necessity, and other named grounds). ANPD published its long-awaited International Data Transfer Regulation (August 2024) and, in January 2026, mutual EU-Brazil adequacy was achieved: the European Commission adopted Implementing Decision 2026/179 recognising Brazil as adequate under GDPR Art. 45, and ANPD's Resolution No. 32/2026 reciprocally recognised the EU as providing adequate protection under the LGPD. Periodic update · new data 2026-09-21 #### Cross-Border & Adequacy Brazil received its first-ever adequacy decision this cycle. Following reciprocal decisions adopted 26 to 27 January 2026, personal data may flow between Brazil and the EU/EEA, including Iceland, Liechtenstein and Norway, without additional transfer safeguards such as Standard Contractual Clauses or Binding Corporate Rules. This is a confirmed, high-materiality development affecting the transfer mechanism landscape in both directions. On the EU side, the European Commission adopted its adequacy decision on 26 January 2026 under GDPR Article 45, finding Brazil's LGPD-based framework essentially equivalent to EU data protection, and permitting EU-to-Brazil transfers without additional safeguards. On the Brazilian side, ANPD's Resolução CD/ANPD 32/2026, adopted 26 to 27 January 2026, formally recognises the European Union, covering all Member States plus Iceland, Liechtenstein and Norway, as providing adequate personal-data protection under LGPD Article 33(I). This recognition is subject to review every four years from the adoption date, and carries an explicit carve-out preserving the need for additional safeguards on transfers related to public security, national defence, or criminal investigation. This reciprocal pairing of decisions is a structural, not episodic, development: it establishes for the first time a bilateral adequacy relationship that eliminates the routine transfer-mechanism burden for the large volume of EU-Brazil personal-data flows, while preserving a defined and narrow carve-out for security-sensitive categories. #### Outlook The adequacy decisions are due for review every four years from the January 2026 adoption date, placing the first formal review point in 2030. In the nearer term, watch for any sector-specific guidance clarifying how the public-security and criminal-investigation carve-out will be applied in practice. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Evidence 7 Sources and claims (7) - Confirmed[IAPP](https://iapp.org/news/a/brazils-new-regulation-on-international-data-transfers) — Article 33 of the LGPD provides an exhaustive list of grounds authorising international data transfers, including adequacy, contractual instruments, ANPD-authorised specific clauses, international cooperation agreements, and data-subject consent.observed 2026-08-03 - Confirmed[EUR-Lex](https://eur-lex.europa.eu/eli/dec_impl/2026/179/oj/eng) — For the purpose of Article 45 of Regulation (EU) 2016/679, Brazil ensures an adequate level of protection for personal data transferred from the European Union to controllers and processors in Brazil subject to the LGPD.observed 2026-08-03 - Confirmed[IAPP](https://iapp.org/news/a/brazil-eu-mutual-adequacy-what-changes-for-data-transfers-and-what-doesn-t) — In Resolution No. 32/2026, ANPD recognized the EU as an international organization providing an adequate level of protection for purposes of international data transfers under the LGPD.observed 2026-08-03 - Confirmed[IAPP](https://iapp.org/news/a/brazils-new-regulation-on-international-data-transfers) — ANPD's SCCs can form a stand-alone contract or be attached to a broader agreement, are divided into general information, mandatory clauses, security measures, and additional clauses/annexes, and unlike EU clauses do not feature modules but customizable fields.observed 2026-08-03 - Confirmed[IAPP](https://iapp.org/news/a/brazils-new-regulation-on-international-data-transfers) — Use of BCRs for intragroup international transfers requires prior ANPD assessment, with data controllers demonstrating compliance including implementation of a data privacy governance program.observed 2026-08-03 - Uncertain[IAPP](https://iapp.org/news/a/brazils-new-regulation-on-international-data-transfers) — There will inevitably be discussions about the adequacy of SCCs and whether additional measures are necessary, mirroring concerns raised in the EU under Schrems II.observed 2026-08-03 - Uncertain[IAPP](https://iapp.org/news/a/brazils-new-regulation-on-international-data-transfers) — Publication of the ANPD international-transfer regulation coincided with discussions of creating a 'sovereign cloud' under Brazil's Artificial Intelligence Plan, aiming to keep government data stored within national borders.observed 2026-08-03