Privacy & Information Security Law Blog

On November 4, 2025, the European Data Protection Board (“EDPB”) adopted its opinion on the European Commission’s draft decision regarding the adequacy of Brazil’s personal data protection framework. Once finalized, this decision will enable the free flow of personal data from the European Union (“EU”) to Brazil.

The EDPB’s opinion, requested by the European Commission, evaluates whether Brazil’s data protection rules and its approach to government access to personal data transferred from the EU for the purposes of law enforcement and national security offer safeguards that are essentially equivalent to those provided under EU law. The EDPB commended Brazil’s legal framework, in particular the General Data Protection Law in Brazil (“LGPD”) together with presidential decrees and binding regulations issued by Brazil’s Data Protection Authority (Agência Nacional de Proteção de Dados, “ANPD”), for its substantial alignment with the EU’s General Data Protection Regulation and relevant EU case law.

Despite generally positive findings, the EDPB invites the European Commission to clarify and monitor several key areas with respect to data protection:

• Data Protection Impact Assessments (“DPIA”): The EDPB recommends monitoring the practical implementation of DPIA requirements in Brazil, ensuring assessments cover necessity and proportionality.
• Transparency Limitations: The EDPB suggested that the LGPD limits the principle of transparency as it may prevent data subjects or the supervisory authority from accessing certain information on their data processing on the grounds of “commercial and industrial secrecy.” The EDPB urges the European Commission to monitor the effect of these limitations on the rights of information and access, and on the powers of the ANPD.
• Onward Transfers: The EDPB advises the European Commission to clarify the rules governing subsequent transfers of EU data from Brazil to third countries.
• Role of Oversight Bodies: The EDPB asks the European Commission to elaborate further on the tasks and interactions between Brazil’s National Council for Personal Data and Privacy Protection and the ANPD.

In addition, the EDPB also opined on the application of the LGPD to data processed by public authorities. As a general rule, the LGPD does not extend to data processed by public authorities for the exclusive purposes of public safety, national defense, state security, or criminal investigation and prosecution. In this respect, the EDPB positively notes that the law partially applies to processing in the context of criminal investigations and public order, as interpreted by Brazil’s Federal Supreme Court. The EDPB encourages the European Commission to specify the applicability of the LGPD to law enforcement processing, clarify the ANPD’s investigatory and corrective powers over law enforcement authorities, and closely monitor developments in this area.

Read the EDPB press release. Read the draft opinion on the adequacy of Brazil’s data protection framework.