European Data Protection Board issues positive opinion on Brazil’s data protection framework

The question

Did the European Data Protection Board (EDPB) identify any inconsistencies between Brazil’s personal data protection regime and the GDPR in its assessment for a potential EU adequacy decision?

The key takeaway

The EDPB’s opinion broadly endorses Brazil’s data protection framework as consistent with the GDPR, particularly in relation to core principles, data subject rights, and oversight structures. However, it has asked the European Commission to clarify several areas before finalising an adequacy decision, including the scope of data protection impact assessments, transparency limitations, onward transfer rules, and safeguards governing public-authority access to data.

The background

In September 2025, the European Commission published a draft adequacy decision concluding that Brazil’s data protection law - the Lei Geral de Proteção de Dados (LGPD) - provides a level of protection for personal data that is essentially equivalent to that under the GDPR.

The draft decision must undergo a three-stage approval process involving:

• review by the EDPB;
• approval by Member State representatives; and
• formal adoption by the Commission, after scrutiny by the European Parliament and Council.

Once adopted, EU–Brazil data transfers would no longer require additional safeguards (e.g. SCCs) or reliance on specific derogations.

On 4 November 2025, the EDPB issued its positive opinion, concluding the second stage of this process.

The development

In its opinion, the EDPB assessed:

• the LGPD’s substantive and procedural safeguards;
• the functioning and independence of Brazil’s supervisory authority (ANPD); and
• the framework governing access to personal data by public authorities, including for law-enforcement and national-security purposes.

The EDPB found strong alignment between the LGPD and the GDPR regarding:

• accountability principles;
• data subject rights;
• rules for international data transfers; and
• oversight and redress mechanisms.

However, the EDPB asked the Commission to provide further clarification and to monitor Brazil’s legal framework in several areas:

• Data Protection Impact Assessments (DPIAs) - the LGPD’s DPIA requirements are less precisely defined than the GDPR’s;
• transparency limitations - the EDPB queried the breadth of exceptions that allow organisations to withhold information from data subjects, including where commercial or industrial secrets are invoked;
• onward transfers - further clarity is needed on when onward transfers outside Brazil may rely on derogations, and what information must be given to individuals;
• public-authority access to data - the EDPB asked the Commission to examine safeguards governing access by law-enforcement and national-security agencies to ensure they meet GDPR-equivalent standards.

Why is this important?

A final adequacy decision would significantly streamline EU-Brazil data flows and reduce the compliance burden for organisations engaging Brazilian processors or partners. It would also represent another step toward international convergence in data protection standards, reinforcing global expectations for rights-based and accountability-driven processing.

However, organisations should not assume full regulatory equivalence. Differences will remain between the GDPR and LGPD frameworks, and businesses must continue to assess their obligations carefully - particularly in areas highlighted by the EDPB for further clarification.

Any practical tips?

Organisations should:

• map existing and future data flows involving Brazil to determine where an adequacy decision could simplify compliance;
• monitor the Commission’s response to the EDPB’s clarifications, as these may shape final adequacy conditions;
• stay updated on the approval timeline, especially if relying on SCCs or derogations for ongoing transfers.

Winter 2025