Open navigation
Search
Offices – Portugal
Explore all Offices
Global Reach

Apart from offering expert legal consultancy for local jurisdictions, CMS partners up with you to effectively navigate the complexities of global business and legal environments.

Explore our reach
Insights – Portugal
Explore all insights
About CMS – Portugal
Search
Expertise
Insights

CMS lawyers can provide future-facing advice for your business across a variety of specialisms and industries, worldwide.

Explore topics
Offices
Global Reach

Apart from offering expert legal consultancy for local jurisdictions, CMS partners up with you to effectively navigate the complexities of global business and legal environments.

Explore our reach
CMS Portugal
Insights
About CMS
More about CMS

Select your region

Newsletter 28 Jan 2026 · Portugal

European Union and Brazil adopt mutual adequacy decision on personal data protection

2 min read

On this page

On 27 January 2026, the European Commission announced the adoption of a mutual adequacy decision with Brazil, recognising that the respective levels of personal data protection are essentially equivalent.

Through this decision —preceded by a favourable opinion of the European Data Protection Board and the approval of the Member States of the European Union under the comitology procedure— the European Commission formally acknowledges that Brazil’s legislative framework on data protection provides safeguards comparable to those established under European Union law, ensuring an adequate level of protection for consumers and citizens.

This recognition constitutes an important milestone in the strengthening of Euro-Brazilian relations and represents a significant boost to digital trade between the two jurisdictions. Adequacy decisions contribute to reducing compliance costs and enhancing legal certainty and stability, benefiting both European companies already established in Brazil and Brazilian companies seeking to expand into the EU market.

It should be recalled that, under the European Union General Data Protection Regulation (“GDPR”), the European Commission has the power to determine whether a third country or an international organisation ensures an adequate level of protection of personal data.

Where such a level of adequacy is recognised, transfers of personal data to the relevant third country or international organisation may take place without the need for specific authorisation or additional transfer mechanisms. In the absence of such a decision, data controllers or processors may only transfer personal data to a third country or an international organisation where appropriate safeguards have been provided and where enforceable data subject rights and effective legal remedies are available, in accordance with Article 46 of the GDPR.

The European Commission will review the functioning of this adequacy decision after a period of four years.

The adequacy decisions currently in force adopted by the European Commission are available on the European Commission’s official website, accessible via the relevant link.

Back to top