Today, the European Commission and Brazil confirmed their comparable data protection standards by adopting mutual adequacy decisions. These agreements allow seamless data exchange between the EU and Brazil, benefiting businesses, public authorities, and researchers.
By enabling secure data flows without additional requirements, the decisions are expected to enhance digital trade, reduce costs, and provide legal certainty for companies in both regions. This initiative establishes the largest global area for free, secure data transfer, benefiting around 670 million consumers.
“Today, the EU is further deepening its ties with one of its most strategic and like-minded partners. Our mutual adequacy decision is a key step in further integrating our economies. It will create new opportunities for our businesses and advance innovation, to the benefit of millions of consumers across Europe and South America,” stated Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy.
These decisions follow the recent Partnership Agreement (EMPA) and Interim Trade Agreement (iTA) signed between the EU and Mercosur. They underscore the commitment to strengthening trade relations and multilateralism. The Commission will review the adequacy of the decision’s effectiveness in four years.
The Constitution of Brazil protects privacy and data protection as fundamental rights, akin to the EU Charter of Fundamental Rights. In 2018, Brazil enacted the General Data Protection Law (LGPD), similar to the EU’s General Data Protection Regulation (GDPR), and established the National Data Protection Authority, a key aspect of the EU framework.
“Brazil has built a strong privacy and data protection framework that safeguards fundamental rights. Together, we have created the world’s largest area for safe, cross-border data flows, covering over 670 million people,” explained Michael McGrath, Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection.
“This agreement boosts digital trade, supports businesses of all sizes, and sets a global benchmark showing that strong privacy protections can coexist with innovation and growth. It sends a clear message: fundamental rights don’t stop at borders, giving consumers confidence that their data is respected and protected,” said Commissioner McGrath.
The LGPD aligns closely with the GDPR in terms of scope, rights, obligations, and enforcement. The European Commission can determine if a country outside the EU ensures adequate data protection. If determined adequate, an adequacy decision allows personal data to flow freely from the EU to that country.
So far, the Commission has recognised Andorra, Argentina, Canada, the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, South Korea, Switzerland, the UK, the US, Uruguay, and the European Patent Organisation as providing adequate protection.
