In a landmark decision, the European Commission concluded that Brazil offers a level of personal data protection equivalent to that of the European Union . This means that data can now flow freely and securely between the two blocs, without the need for additional safeguards, a milestone that could profoundly transform trade, technology, and research relations between Brazil and Europe. The decision is part of the process that began on September 5th, when the Commission published the communication that paved the way for the adoption of an adequacy agreement between the two regions. According to a European Commission spokesperson, the measure could benefit 670 million consumers and boost not only trade relations but also research cooperation. “The process for adopting the adequacy decision still requires an opinion from the European Data Protection Board, analysis by the European Parliament, and final approval by the European Union Member States,” the spokesperson said.
The decision represents a seal of international trust for Brazil, recognizing not only its General Data Protection Law (LGPD), but also a robust system of constitutional, judicial, and regulatory guarantees. “The decision serves as a mark of trust,” says Josué Fama, Data Protection Officer (DPO) at Atlântico Institute. “It’s a transition from an environment of uncertainty to one of mutual trust,” he adds.
How will it work?
In practice, Brazilian companies no longer face onerous regulatory barriers to doing business with European partners. “Negotiations become more agile, projects start faster, and partnerships are built on a foundation of security and predictability,” explains Josué. He also emphasizes that this new phase requires proactive action from companies: “It’s time to tell a new story about Brazil, a story of digital maturity and alignment with the highest global standards.”
According to the expert, the decision allows for safer innovation, exploring technologies such as artificial intelligence, digital health, and smart cities. “We now speak the same regulatory language as Europe.”
The Atlantic Institute, which operates as a technology innovation hub, sees the decision as an opportunity to strengthen its role as a bridge between Brazil and the European ecosystem. “We want to be the innovation hub that European companies seek to develop the next generation of technology,” says Josué.
Decision makes life easier for Brazilian entrepreneurs
With the decision, transfer mechanisms such as Standard Contractual Clauses are no longer required, simplifying legal processes. “It’s like having a passport that waives the need for a visa but still requires compliance with the laws of the destination country,” Josué compares. Brazil, he says, has demonstrated not only maturity, but excellence: “Passing this rigorous assessment puts us alongside powers like the United Kingdom, Japan, and Canada.”
In addition to the commercial gains, Josué highlights the measure’s symbolic impact: “We’ve gone from ‘Brazil risk’ to ‘Brazil confidence’ in the digital domain.” This, he says, attracts investment, accelerates partnerships, and strengthens the country’s position as a global benchmark.
The decision is not 100% closed yet.
The decision will still be submitted to the European Data Protection Board for review, the European Parliament, and the approval of the member states. In parallel, Brazil is also working on a reciprocal decision to allow the flow of data from Europe to Brazil.
For Josué, the most important thing is to remember that behind regulation and technology are people. “This decision is about protecting the rights of more than 670 million citizens. The technology we create must serve this greater purpose. This regulatory framework is the beginning of a new phase, and we are ready to build on it.”
Check out the full interview with Josué Fama below:
DP Tech Trends – How does this European Commission decision impact Brazilian companies?
Josué Fama – The impact goes beyond simply reducing costs and bureaucracy. We’re talking about a fundamental shift in how Brazil is perceived in the global digital landscape. The decision serves as a mark of trust. For a European company, choosing a Brazilian partner is no longer a decision that requires extensive and complex legal risk analyses, but rather a more strategic choice, based on the quality and innovation we offer.
This decision represents a transition from an environment of uncertainty to one of reciprocal/mutual trust. This means negotiations become more agile, projects can start faster, and partnerships will be built on a foundation of security and predictability that simply didn’t exist at such a formal level before.
DPTT – How can Brazilian companies benefit from this European Commission decision?
JF – This is a time for proactivity. Beyond being a sales pitch, this decision allows us to tell a new story about Brazil. A story of digital maturity, respect for fundamental rights, and alignment with the highest global standards. Companies will be able to:
a) build relationships/bridges of trust, meaning that instead of just selling compliance, we can sell strategic partnerships. We can say to a European client: “Do business with us because we share the same data protection values as you. We speak the same regulatory language.”
b) innovate more safely: the decision invites us to explore new technologies, meaning we can create solutions that involve more intensive data processing, such as artificial intelligence, digital health, or smart cities, with the certainty that the legal basis for collaboration with Europe is legally solid.
DPTT – Is the Atlântico Institute analyzing how to help its partners and how it itself can take advantage of this milestone for Brazil?
JF – Without a doubt. Our mission at Atlântico is to be at the forefront of innovation, and that includes regulatory innovation. We see our role as contributing to these connections between industry, government, and technology to continue to grow stronger.
For our partners, we want to help redesign the best commercial strategies, explore new markets, and build marketing strategies that resonate with the trust this milestone establishes. For Atlântico, it’s not just about receiving data, but about co-creating value in an ecosystem of mutual trust. This opens the door to more ambitious R&D projects with European partners, where the exchange of knowledge and research data flows more securely and efficiently. We want to be the innovation hub that European companies seek to develop the next generation of technology.
DPTT – You mention in the post that this would facilitate the free flow of data between the European Union and Brazil (companies, governments, research). Would this free flow be automatic or dependent on some agreement or arrangement?
JF – The beauty of this decision is that the flow becomes “automatic,” in the sense that the main barrier, the need for a transfer mechanism like the Standard Contractual Clauses (see Resolution No. 19/ANPD), disappears. It’s like having a passport that doesn’t require a visa.
However, still using the analogy, a passport allows travel, but it doesn’t exempt anyone from respecting the laws of the country they’re visiting. Likewise, Brazilian companies must continue to treat data with the utmost rigor, following each principle of the LGPD. Compliance is a vote of confidence, and our responsibility is to honor it every day.
DPTT – Does this decision demonstrate Brazil’s maturity in terms of data protection?
JF – It shows more than maturity; it shows excellence. As the ANPD, the Regulatory Agency, itself highlighted, this was “the most comprehensive process ever conducted by the European Union.” Passing this rigorous assessment places us in a select group of nations, alongside powerhouses like the United Kingdom, Japan, and Canada.
And the fact that the ANPD is working on a reciprocal decision elevates Brazil from the position of “evaluated” to that of an equal partner. We are building a relationship of regulatory symmetry, where trust is a two-way street. This is the true sign of a mature ecosystem.
DPTT – The European Commission is committed to protecting the privacy rights of its citizens. Does the decision you shared in your post show that, despite necessary adjustments, Brazil is on the right path to strengthening privacy, transparency, and security?
JF – Yes. The European Commission didn’t just look at the LGPD. They analyzed our foundation: a Constitution that treats privacy as a fundamental right, a Judiciary that guarantees redress (such as habeas data), and an independent and active ANPD. They recognized that we have not just a law, but a robust and functional system of guarantees. This confirms that our journey, although recent, is built on solid foundations and is headed in the right direction.
DPTT – You argue that this decision establishes a regulatory framework: consolidating the LGPD and ANPD as global benchmarks. What impact does this have on perceptions of the Brazilian technology and government sectors abroad, and how might this impact business and the exchange of experiences between Brazil and Europe?
JF – The impact is a shift in narrative. We can say that we’ve gone from “Brazil risk” to “Brazil confidence” in the digital domain.
As ANPD president Waldemar Gonçalves stated, this is a “strategic measure to boost trade relations.” This translates into more investment, meaning European capital will flow more securely into Brazilian technology. Deeper collaboration and dialogue between our innovation ecosystems will be spoken in a “regulatory lingua franca.” This accelerates partnerships, joint ventures, and talent exchange. Beyond global leadership, Brazil consolidates itself not only as a consumer market but also as a benchmark, an active player in global discussions on how to shape a safer and more ethical digital future.
DPTT – Anything else to comment?
JF – Yes. At the center of all this technical and legal discussion are people. This decision, at its core, is about protecting the rights of more than 670 million citizens, both Brazilian and European. It’s about ensuring that, in the digital economy, human dignity and the power to choose one’s data are respected, no matter which side of the Atlantic we’re on. For us at the Atlantic Institute, this is the true motivation. The technology we create and the projects we lead must serve this greater purpose. This regulatory framework is the beginning of a new phase, full of potential. We are positioned not only to witness, but to actively build this future.
Who is the Atlântico Institute?
Atlântico is a Science and Technology Institution (ICT), structured as a non-profit private law civil association, focused on promoting innovation through research and development in ICT. Founded by CPqD and PADTEC, Atlântico is one of Brazil’s leading ICTs, located in the Northeast region. We are an innovation ecosystem, uniting research, development, academia, the market, and education. More than 500 talented professionals, certified in their fields, create a harmonious and collaborative work environment, offering freedom of experimentation and close proximity to the client.
Image: FreePik
