On 5 November 2025 the EDPB issued its opinion on the draft adequacy decision in favour of Brazil. The opinion was generally positive with the EDPB noting strong alignment between Brazil’s data protection legislation and the EU GDPR, including the recognition of privacy and data protection in Brazil’s legislation, an independent authority with regulatory and enforcement powers and core principles mirroring the GDPR standards.
The EDPB identified several areas where clarification is needed, being, the effective implementation of DPIAs, consideration of limitations on transparency related to commercial and industrial secrecy, the need for clearer rules on transfers of data from Brazil to other countries, processing by public authorities (which is not governed by the main data protection legislation) and clarification on the investigatory and enforcement powers of the data protection authority.
The opinion can be found here.
