On 26 January 2026, Brazil and Europe adopted mutual adequacy decisions regarding international transfers of personal data. The European Commission adopted an adequacy decision for Brazil under Article 45 GDPR, enabling transfers from the EU to Brazil. The Brazilian data protection authority (ANPD) adopted Resolution No. 32/2026 recognizing the EU as providing an adequate level of protection under Article 33 (I) LGPD, which permits transfers from Brazil to the EU.
This article outlines what adequacy changes in practice, covering the new default transfer logic, the reduction of transfer-specific formalities, the continued importance of mapping data flows and onward transfers, and the fact that core compliance obligations under the LGPD and GDPR still apply.
Practical Impacts Deriving From the Mutual Adequacy Decisions
1) A New Default International Transfer Mechanism
Adequacy changes the default approach so that, instead of relying on safeguards as the first option, organizations can rely on adequacy whenever the transfer destination falls within the scope of the referred adequacy decisions.
2) Reduced Transfer-Specific Contracting Overhead
Adequacy reduces transfer-specific contracting: For Brazil to EU transfers covered by ANPD’s decision, organizations can generally rely on LGPD Article 33(I) rather than implementing Brazilian Standard Contractual Clauses (SCCs) as the transfer mechanism. For EU to Brazil transfers covered by the EU decision, EU exporters generally avoid GDPR SCCs as the baseline transfer tool.
This can shorten vendor onboarding and procurement for cross-border transactions. Contracting efforts should focus on operational provisions that remain necessary irrespective of adequacy, including security measures, breach handling, audit rights, sub-processing controls, and retention.
3) Stronger Emphasis on Transfer Mapping (“Know Your Transfers”)
Adequacy does not remove the need to understand data flows. Organizations still need to know (map) their transfers, so that they can prevent “silent” onward transfers.
4) Monitoring and Contingency
Adequacy is not irrevocable. The EU adequacy framework under the GDPR highlights monitoring and periodic review. For critical services, it is recommended to have a fallback plan if conditions change, for example keeping SCCs readiness.
Core LGPD and GDPR Obligations Remain Unchanged
Adequacy only addresses the transfer mechanism. The underlying processing must still comply with the substantive requirements of the LGPD and the GDPR, including:
- Lawful basis and purpose limitation, aligned with other core principles such as necessity, transparency, security, and accountability.
- Records of processing activities that accurately document cross-border processing, recipients, purposes, and applicable transfer mechanisms.
- Controller–processor governance, supported by a data processing agreement defining instructions, sub-processing conditions, assistance with rights requests, and end-of-service data return or deletion.
- Security and incident management, including appropriate technical and organizational measures and incident response processes.
- Transparency and data subject rights handling, through privacy notices and operational workflows for data subject rights and complaints that function across the cross-border operations.
Conclusion
The mutual adequacy decisions simplify many EU-Brazil and Brazil-EU transfers by allowing organizations to rely on adequacy as the default transfer mechanism and by reducing transfer-specific contracting burdens. At the same time, adequacy reinforces the need for disciplined transfer mapping to control onward transfers and for monitoring and contingency planning.