Both adequacy decisions follow the new partnership and trade agreements between the EU and Brazil, which aim to create a solid foundation for cross-border trade. With its decision, the European Commission recognises that Brazil offers adequate protection for data flowing from the EU.
Based on the adequacy decision, companies can transfer personal data in the same way as within the EU/EEA, subject to compliance with the data protection rules. In that connection, companies need to remember certain basic questions, such as:
- What is the lawful basis for our processing activity?
- How have we informed data subjects about our international transfers?
- What mechanism do we apply when no adequacy decision is in place?
- What other steps do we need to take to protect the information?
Third countries subject to adequacy decisions are continuously monitored by the European Commission to ensure the level of data protection. The adequacy decision for Brazil will be re-evaluated again in four years.
iuno’s opinion
International data transfers are an integral part of the work within many companies. Adequacy decisions are therefore only an effective way to assist business flows. Nonetheless, the reality is that most third countries are not subject to such a decision, and that other measures must be put in place. We have written more about that here.
iuno recommends establishing procedures to ensure international data transfers are compliant. That includes, among other steps, creating an overview of the countries you are dealing with as part of your processing activities.
[European Commission Implementing Decision of 26 January 2026]