Commission adopts adequacy decision on Brazil’s data protection regime
The European Commission has adopted an implementing decision confirming that Brazil ensures an adequate level of protection for personal data transferred from the European Union under Regulation (EU) 2016/679 (General Data Protection Regulation (GDPR)). The decision concludes that Brazil’s legal framework, in particular the General Data Protection Law (LGPD), provides a level of protection for personal data that is essentially equivalent to that guaranteed within the EU, including enforceable rights for data subjects, effective oversight by an independent supervisory authority, and safeguards on access to data by public authorities. As a result, transfers of personal data from controllers and processors in the EU to controllers and processors in Brazil may take place without the need for additional authorisation under Chapter V of the GDPR. The decision is binding on Member States and will be subject to periodic review.