On September 5, 2025, the European Commission published a draft adequacy decision recognizing Brazil’s data protection regime, anchored by the Lei Geral de Proteção de Dados (LGPD), as providing an essentially equivalent level of protection to the EU’s General Data Protection Regulation (GDPR).

If adopted, Brazil would join the select group of countries such as Japan, South Korea, Canada, Argentina, Uruguay, and notably, the UK, that already enjoy adequacy status. This development is a landmark moment not only for Brazil, but also for businesses and regulators across the EU and UK.

Why this matters

Adequacy matters for Brazil, the EU and the UK in distinct but interconnected ways.

For Brazil, achieving adequacy would establish the country as a trusted global partner and reinforce its standing as a regional leader in privacy and data governance. This recognition would bolster Brazil’s reputation as a secure hub for international trade and digital services. It would also simplify commercial relations, as Brazilian companies working with European clients would no longer need to rely on Standard Contractual Clauses or other complex transfer mechanisms. Beyond easing compliance, adequacy would create a more attractive environment for investment and innovation. Interoperability with the GDPR provides clarity for foreign investors, cloud service providers, research institutions, and cross-border collaborations. At the same time, adequacy would validate the regulatory maturity of Brazil’s data protection authority, the ANPD, affirming its credibility and capacity for independent enforcement and oversight.

For the EU, adequacy with Brazil offers clear compliance advantages. EU organizations could transfer data freely to Brazilian partners, eliminating unnecessary legal and administrative burdens. This creates legal certainty, providing a stable and predictable framework for international data flows at a moment when transfers face heightened scrutiny in the wake of Schrems II. Strategically, adequacy also contributes to global convergence, aligning Europe and Brazil in a way that reinforces the EU’s role as the global benchmark for privacy standards.

For the UK, while no longer part of the EU, the implications are still significant. Brazil is one of the UK’s most important trading partners in Latin America, and once EU adequacy is in place, UK businesses will likely press for similar recognition under the UK GDPR. Such developments could pave the way for triangular adequacy among the EU, Brazil, and the UK, ensuring seamless data flows across all three jurisdictions. However, if the EU finalizes adequacy with Brazil before the UK does, British firms risk competitive disadvantages compared to their EU counterparts, particularly in digital services, outsourcing, and fintech partnerships. Recognizing this, the UK’s Information Commissioner’s Office may view Brazil’s EU adequacy as a catalyst to accelerate its own adequacy process, ensuring UK companies remain competitive in both transatlantic and South-South data flows.

Next steps

This is still a draft decision. Before final adoption:

• The European Data Protection Board (EDPB) will issue its opinion 
• Member States will review the draft through the comitology procedure, which is the EU’s way of letting member states oversee Commission decisions 
• The European Parliament and Council will have oversight before the Commission can formally adopt 

On the Brazilian side:

• The ANPD is finalizing its own reciprocal adequacy decision, recognizing the EU as equivalent under the LGPD’s International Data Transfer Regulation 
• Once adopted, this will create mutual recognition, providing two-way legal certainty for companies, governments, and research institutions 

What should companies do now?

• Brazilian companies should prepare for increased European engagement by ensuring compliance maturity with LGPD, particularly around international transfers, DPIAs and record-keeping. 
• EU companies working with Brazilian partners can anticipate simpler contracts and reduced legal costs, but should monitor the procedural steps until adequacy is formally adopted. 
• UK companies should watch closely. Adequacy is not yet extended to the UK, meaning SCCs or transfer mechanisms remain necessary for UK–Brazil flows. Strategic planning now could avoid bottlenecks later. 

A global turning point?

Adequacy between the EU and Brazil is not just a technical legal step. It is a symbolic milestone in the globalization of privacy standards. Ten years ago, the LGPD was only a draft bill under debate in Brasília. Today, Brazil is on the cusp of being recognized as a global leader in data protection.

For companies in Brazil, the EU and the UK, this is more than compliance. It is an opportunity to streamline operations, strengthen trust and compete globally in a digital economy where data protection is both a legal requirement and a market differentiator.

Our Guide to Brazil’s LGPD will tell you all you need to know about the new legislation. Get it here.