Recent Developments Mark A New Era In Brazil's - Digital Landscape And Its Relationship With The European Union

European Commission's Draft Adequacy Decision Paves the Way for Seamless Data Transfers Between Brazil and the European Union

On September 5, 2025, the European Commission published a draft decision on the adequacy of Brazil's level of personal data protection, concluding that Brazil ensures a level of protection for personal data that is "essentially equivalent" to that guaranteed within the European Union under the General Data Protection Regulation (GDPR).

The draft adequacy decision must still be reviewed by the European Data Protection Board, approved by representatives of the EU Member States, and scrutinized by the European Parliament. Nonetheless, it already marks a significant milestone in EU–Brazil relations. To date, only a limited number of countries — including Argentina and Uruguay — have been granted adequacy status for the transfer of personal data from the European Union. Without adequacy status, cross-border data transfers from the European Union require appropriate safeguards, such as standard data protection clauses, binding corporate rules, codes of conduct, certification mechanisms and ad hoc contractual clauses, all of which require significant legal, administrative, and operational resources.

The European Commission's assessment of Brazil's data protection framework considered not only Brazil's comprehensive General Data Protection Law (LGDP), but also fundamental rights protected by the Brazilian Constitution — including the right to privacy and data protection — as well as Brazil's adherence to the American Convention on Human Rights and recognition of the jurisdiction of the Inter-American Court of Human Rights. The Commission also examined the role of the National Data Protection Authority (ANPD), Brazil's independent regulatory authority responsible for interpreting and enforcing the LGPD. The Commission emphasized that, as part of Brazil's international engagement in promoting and protecting data protection rights, ANPD became a member of the Global Privacy Assembly in 2023. Additionally, Brazil joined, as an observer, the Council of Europe's Committee on the Convention 108 for the protection of individuals concerning the automatic processing of personal data.

Once formally adopted, the adequacy decision will allow personal data to be transferred from the European Union to Brazil without the need for further authorization or the above-mentioned safeguards. Brazil's ANPD is expected to issue a reciprocal adequacy decision to enable the free flow of personal data from Brazil to the European Union. By providing legal certainty and facilitating cross-border data transfers, these adequacy decisions will contribute to a stronger environment for business relations and international cooperation between Brazil and the European Union.

Implications of Brazil's Expected Adequacy Status for Businesses

Brazil's adequacy status will significantly streamline operations for companies handling personal data between Brazil and the European Union and foster new opportunities for trade, investment, and digital innovation across both markets. Companies will be able to transfer personal data without additional legal steps or certification mechanisms, thereby reducing compliance costs and operational complexity. This simplification will also enable faster transactions, closer commercial collaboration, and provide businesses with greater legal certainty when structuring cross-border projects and partnerships.

In this connection, the adequacy decision is expected to strengthen Brazil's position as a strategic hub for data storage and processing in Latin America. With cross-border transfers no longer requiring additional safeguards, companies will be more likely to host and manage data in Brazil, driving demand for local data centers and cloud services. This simplified regulatory environment will make Brazil more attractive to European businesses expanding into the region and support the growth of digital services that depend on secure and efficient data infrastructure, such as cloud computing, SaaS platforms and AI-driven solutions.

Other data-intensive sectors will also benefit from seamless EU–Brazil data flows, including:

• Fintech and financial services, where data sharing is critical for transactions, fraud prevention, and regulatory reporting.
• Health tech and life sciences, which rely on cross-border data for research, clinical trials, and digital health solutions.
• E-commerce and digital platforms, where seamless data flows support customer engagement, logistics, and personalization.

Special Tax Regimes

On September 17, 2025, the President of Brazil enacted Provisional Measure No. 1.318/2025, which took immediate effect but must be approved by Congress within 120 days to become permanent law. This measure introduces two new special tax regimes: REDATA (Special Tax Regime for Datacenter Services) and REPES (Special Tax Regime for the Export Platform of Information Technology Services).

The main goal of this legislation is to strengthen Brazil's digital economy by attracting investment in datacenter infrastructure and positioning the country as a regional hub for digital services, including artificial intelligence and cloud computing.

REDATA is designed for companies that are either establishing new datacenters or expanding existing ones in Brazil. It also extends benefits to suppliers of information and communication technology (ICT) products that are incorporated into the fixed assets of these datacenters. Under REDATA, qualifying companies will be eligible for significant federal tax suspensions starting January 1, 2026. These include the suspension of PIS/Cofins (social contributions), IPI (excise tax), and import duties on qualifying fixed asset goods—provided there is no domestic equivalent for the imported item.

To benefit from REDATA, companies must meet several requirements:

• At least 10% of the datacenter's capacity must be allocated to the domestic (Brazilian) market.
• The datacenter must comply with sustainability standards as defined by the relevant regulatory authorities.
• All electricity used by the datacenter must come from clean or renewable energy sources, either through direct supply contracts or self-generation.
• The datacenter must achieve a water usage effectiveness (WUE) of no more than 0.05 liters per kilowatt-hour on an annual basis, demonstrating efficient water use and reuse.
• The company must invest at least 2% of the value of all products purchased under REDATA (whether domestic or imported) in research, development, and innovation projects in Brazil. These investments must be made in partnership with local scientific, technological, or educational institutions and should align with national digital economy priorities.
• The company must be in good standing with federal tax authorities and cannot be under the Simples Nacional tax regime (a simplified tax regime for small businesses).

REPES, on the other hand, is aimed at companies primarily engaged in software development or IT services (excluding datacenter services) that commit to exporting at least 50% of their annual gross revenue. REPES offers similar tax suspensions for qualifying goods and services used in export activities.

Both regimes require companies to apply to the Brazilian Federal Revenue Service and demonstrate compliance with all requirements before benefits are granted. The REDATA tax benefits are set to begin on January 1, 2026, and are currently limited to the year 2026, as Brazil is transitioning to a new tax regime in 2027. However, the suspension of import duties under REDATA can last for up to five years.

In summary, Provisional Measure No. 1.318/2025 offers a powerful set of incentives for companies willing to invest in Brazil's digital infrastructure, provided they meet strict sustainability, local market, and innovation requirements. The measure is part of a broader strategy to make Brazil a leader in digital services in Latin America.

Comment

The European Commission's draft adequacy decision for Brazil and the introduction of Brazil's new special tax regimes—REDATA and REPES—together mark a transformative moment for the country's digital landscape and its relationship with the European Union.

If the adequacy decision is formally adopted, Brazil will join a select group of countries recognized as providing "essentially equivalent" data protection to that of the EU. This will enable seamless, secure, and legally certain transfers of personal data between Brazil and the EU, eliminating the need for complex contractual safeguards and reducing compliance burdens for businesses on both sides. As a result, companies will benefit from faster, more cost-effective cross-border operations, and Brazil is likely to become an even more attractive destination for European investment, digital services, and innovation.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.