EDPB Adopts Opinion on EU–Brazil Adequacy Decision, Recommending Clarifications on Transparency and Enforcement

Key Takeaways

• On 4 November 2025, the European Data Protection Board (EDPB) adopted its opinion on the European Commission’s draft adequacy decision for Brazil.

• Once adopted, this adequacy decision will enable the free flow of personal data from the European Union (EU) to Brazil, removing the need for Standard Contractual Clauses (SCCs) or other transfer mechanisms.

• The EDPB welcomed Brazil’s strong alignment with the EU General Data Protection Regulation (GDPR) and relevant Court of Justice of the European Union (CJEU) case law.

• The Board, however, identified four areas for clarification and monitoring: Data Protection Impact Assessments (DPIAs), transparency limitations, onward transfers, and oversight governance.

• The opinion also examines the scope of Brazil’s data protection law (LGPD) regarding law enforcement and national security processing, calling for additional specification.

Brussels, 5 November 2025 — EDPB Endorses the EU–Brazil Adequacy Effort

At its plenary session on 4 November 2025, the European Data Protection Board (EDPB) issued a long-awaited opinion on the European Commission’s draft adequacy decision for Brazil.

Once finalized, this decision will enable personal data to move freely between the EU and Brazil, granting both businesses and public authorities legal certainty and ensuring that individuals retain robust control over their personal data.

The EDPB’s opinion—formally requested by the Commission—assesses whether Brazil’s data protection laws and its approach to government access to EU-origin data provide safeguards essentially equivalent to those required under EU law.

Alignment Recognized: Brazil’s Legal Framework Mirrors the GDPR

The EDPB commends Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados – LGPD), supported by presidential decrees and binding regulations from the Agência Nacional de Proteção de Dados (ANPD), for achieving substantial alignment with the GDPR.

The Board’s analysis confirmed that the LGPD’s key principles—including lawfulness, fairness, purpose limitation, necessity, transparency, and accountability—closely track those of the GDPR.

Moreover, the independence, powers, and regulatory activity of the ANPD were seen as reinforcing the adequacy of Brazil’s overall framework.

What Changed Between the Draft Adequacy Decision and the EDPB’s Opinion

The September 2025 draft adequacy decision was generally positive, but the EDPB’s opinion introduces a more granular assessment and specific recommendations aimed at ensuring durable compliance and consistent protection over time.

1. Greater Focus on Enforcement and Practical Implementation

While the draft decision largely confirmed Brazil’s legal equivalence on paper, the EDPB now calls for ongoing monitoring of how the LGPD is applied in practice—particularly the ANPD’s enforcement powers and its coordination with other government entities.

2. Clarification on DPIA Requirements

The EDPB highlights the need to assess the practical execution of Data Protection Impact Assessments (DPIAs) in Brazil, emphasizing that they must address necessity and proportionality—an expectation not explicitly detailed in the Commission’s draft.

3. Transparency and Secrecy Limitations

The draft decision acknowledged Brazil’s transparency obligations but did not expressly analyze the “commercial and industrial secrecy” limitation in the LGPD. The EDPB’s opinion now urges the Commission to evaluate and monitor whether this limitation impedes data subject rights or restricts ANPD oversight.

4. Onward Transfers and International Data Sharing

The EDPB’s opinion adds a recommendation for the Commission to clarify the treatment of onward transfers from Brazil to other third countries, ensuring that EU-origin data retains its protection throughout subsequent processing chains.

5. Oversight Architecture and Institutional Roles

While the draft decision referenced the National Council for Personal Data and Privacy Protection, the EDPB explicitly calls for a clearer description of how it interacts with the ANPD and whether this division of roles enhances or fragments supervision.

6. Law Enforcement and National Security Carve-outs

The EDPB introduces a more nuanced view of the LGPD’s exemptions for public safety, national defense, state security, and criminal investigation, urging the Commission to specify the scope of applicability and to monitor judicial and legislative developments in this area.

Core Issues Highlighted by the EDPB

Beyond the refinements to the draft decision, the EDPB pinpointed four primary areas warranting continued oversight and clarification by the European Commission:

1. Data Protection Impact Assessments (DPIAs)

The Board recommends evaluating the practical functioning of Brazil’s DPIA regime, ensuring that it captures the necessity and proportionality of high-risk processing operations, as under Articles 35–36 GDPR.

2. Transparency Limitations

The EDPB expressed concern that commercial and industrial secrecy exceptions in the LGPD might limit transparency and the ANPD’s ability to access information necessary for supervision. The Board urges the Commission to track the real-world impact of these provisions.

3. Onward Transfers

The EDPB requests further clarification on the rules governing subsequent transfers of EU data from Brazil to other countries, ensuring that GDPR-level protections continue to apply in those downstream contexts.

4. Oversight and Institutional Cooperation

The opinion calls on the Commission to detail the functional relationship between Brazil’s National Council for Personal Data and Privacy Protection and the ANPD, ensuring a clear delineation of authority and avoiding overlaps that could weaken oversight.

Law Enforcement and National Security: A Qualified Approach

The EDPB also reviewed how the LGPD applies to data processing by Brazilian public authorities.
As a general rule, the LGPD does not extend to processing conducted exclusively for public safety, national defense, state security, or criminal investigation and prosecution.

However, the Federal Supreme Court of Brazil has interpreted the LGPD as partially applicable to criminal investigations and the maintenance of public order, introducing a degree of oversight previously absent.

The EDPB views this interpretation as a positive development, but advises the Commission to:

• Specify how the LGPD applies to law enforcement processing;

• Clarify the ANPD’s investigative and corrective powers over law enforcement agencies; and

• Define more precisely the contours of Brazil’s national security concept as it relates to data protection.

Conclusion: Toward an Adequacy Decision Built on Accountability and Trust

The EDPB’s opinion reinforces the European Commission’s confidence in Brazil’s data protection regime while ensuring that key implementation issues remain subject to continued oversight.

Once the adequacy decision is formally adopted, organizations across the EU and Brazil will benefit from frictionless data transfers, enhanced regulatory certainty, and a shared foundation of privacy principles rooted in accountability and individual rights.

The opinion represents not only a step forward in EU–Brazil digital cooperation but also a broader affirmation of GDPR’s global influence—with Brazil’s LGPD emerging as a leading model of privacy governance in the Southern Hemisphere.