📜 EU-Brazil Adequacy Decision: Is the End of SCCs Near?

The European Commission is proposing to recognize Brazil’s LGPD as equivalent to the GDPR. I analyzed what this means for data flows and digital sovereignty.

The European Commission has published Brazil’s draft adequacy decision. This is a milestone, long awaited. More than just an administrative act, its release on September 5, 2025, marks the formal recognition that Brazil’s data protection framework has reached a level of maturity “essentially equivalent” to the GDPR.

Easy now, it’s still just a draft. But for companies handling data flows between Brazil and the European Union, including many European multinationals operating in Brazil, this is a game changer.

If approved, the proposal will remove the need for additional safeguards like Standard Contractual Clauses (SCCs) and complex Transfer Impact Assessments (TIAs), dramatically simplifying cross-border operations.

The decision validates not only the LGPD, but also the independence and enforcement powers of Brazil’s data protection authority, the ANPD. The European Commission’s draft dedicates a detailed analysis to the ANPD’s structure, highlighting its transformation into a special independent authority with technical and decision-making autonomy. That was no easy feat, it was a major achievement by the ANPD, the result of years of political effort.

The EU is signaling that having a strong regulator, with its own budget, directors with fixed mandates, and powers to investigate and sanction both the private and public sectors, is a non-negotiable pillar for regulatory trust. The ANPD’s concrete actions, from regulating data transfers to enforcing penalties, were cited as evidence of this effectiveness.

One key example is the approval of government access safeguards, which require prior judicial authorization. This is the central post-Schrems II argument that will be tested by the European Data Protection Board (EDPB), the next critical step in the approval process.

The European assessment concluded that Brazil’s legal system imposes clear and precise limits on access to data by security and intelligence authorities, requiring, as a general rule, a court order grounded in necessity and proportionality. In addition, Brazil offers effective redress mechanisms, such as the Habeas Data remedy and the ability to bring legal action against the State, both available to any individual regardless of nationality.

If the EDPB issues a favorable opinion and member states give their approval, Brazil will join a select group of countries, setting a new paradigm for data flows and consolidating its role as a key player in the global digital economy for data processing.