Commission Implementing Decision (EU) 2026/179 of 26 January 2026 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data by Brazil (notified under document C(2026) 373)
Data as of 2026-07-04 · Compiled from an official source version. Later amendments or repeals may not be reflected; the official text prevails. · Read the official text ↗
For the purpose of Article 45 of Regulation (EU) 2016/679, Brazil ensures an adequate level of protection for personal data transferred from the European Union to controllers and processors in Brazil subject to the General Data Protection Law (LGPD).
Whenever the competent authorities in Member States, in order to protect individuals with regard to the processing of their personal data, exercise their powers pursuant to Article 58 of Regulation (EU) 2016/679 with respect to data transfers falling within the scope of application set out in Article 1, the Member State concerned shall inform the Commission without delay.
1. The Commission shall continuously monitor the application of the legal framework upon which this Decision is based with a view to assessing whether Brazil continues to ensure an adequate level of protection within the meaning of Article 1. 2. The Member States and the Commission shall inform each other of cases where the Brazilian Data Protection Authority (Agência Nacional de Proteção de Dados – ANPD), or any other competent Brazilian authority, fails to ensure compliance with the legal framework upon which this Decision is based. 3. The Member States and the Commission shall inform each other of any indications that interferences by Brazilian public authorities with the right of individuals to the protection of their personal data go beyond what is strictly necessary, or that there is no effective legal protection against such interferences. 4. After four years from the date of the notification of this Decision to the Member States and subsequently at least every four years, the Commission shall evaluate the finding in Article 1 on the basis of all available information, including the information received as part of the review carried out together with the relevant Brazilian authorities. 5. Where the Commission has indications that an adequate level of protection is no longer ensured, the Commission shall inform the competent Brazilian authorities and may suspend, repeal, or amend this Decision. 6. The Commission may also suspend, repeal, or amend this Decision if the lack of cooperation of the Brazilian government prevents the Commission from determining whether the finding in Article 1 of this Decision is affected.
This Decision is addressed to the Member States.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.