Cybersecurity Policy Report, Brazilian Privacy Agency Comments on EU Draft Adequacy Decision, (Sep 8, 2025)

By Tony Foley

Brazil’s National Authority for the Protection of Data (ANPD) has acknowledged the European Commission’s recent draft adequacy decision in which the commission recognized that Brazil offers a level of personal data protection equivalent to that provided in the EU General Data Protection Regulation (GDPR).

The commission announced its draft decision on Friday, stating that the 2018 General Data Protection Law (LGPD) provides “safeguards for all individuals, irrespective of their nationality” and has been strengthened in recent years, including by establishing the ANPD as an independent data protection authority authorized to implement the law’s provisions (CPR, Sept. 5).

In a notice issued the same day, ANPD said that, on its completion, the adequacy decision will ensure greater legal certainty and will result in the free and secure circulation of personal data between Brazil and EU countries without the need for additional protective measures. ANPD added that it is in the process of issuing its own adequacy decision recognizing the equivalence of EU legislation, including the GDPR, with the protective regime established under the LGPD. This process is in its final stages and, after completion and legal evaluation, will be submitted for final deliberation by the LGPD Board of Directors.

“It’s worth noting that the European Union is one of Brazil’s most important trading partners,” said ANPD CEO Waldemar Gonçalves. “Having a harmonious legal framework for personal data protection is a strategic measure to boost trade relations with the European bloc, always preserving the rights of data subjects,” he added.

ANPD noted that the EU must obtain an opinion from the European Data Protection Board (EDPB) and approval from a committee of EU Member State representatives before the adequacy decision may be finalized. Brazil is poised to join 16 other countries already recognized as adequate by the commission, including the United Kingdom, Canada, Japan, South Korea, Argentina, and South Korea.

News: InternationalLegislation DataPrivacy GDPR