Adequacy · EU ·
Brazil is adequate for the GDPR, not yet for the FADP
By Advisorn · guidance, not advice
In brief
Since 28 January 2026 data may go from the EU and the EEA to Brazil without additional safeguards, thanks to adequacy decision (EU) 2026/179. Under the FADP, Brazil is not listed in Annex 1 to the Data Protection Ordinance: a disclosure from Switzerland still requires safeguards such as standard contractual clauses.
What happened
On 26 January 2026 the European Commission adopted Implementing Decision (EU) 2026/179, under which Brazil ensures adequate protection within the meaning of Art. 45 GDPR. It was published and entered into force on 28 January 2026. Brazil in turn adopted an adequacy decision for the EU.
In Switzerland the adequate countries are decided by the Federal Council in Annex 1 to the Data Protection Ordinance, which does not include Brazil.
What it means for an SME
If you process data under the GDPR from an establishment in the EU, you can transfer them to Brazil without standard contractual clauses.
If you send them from Switzerland, appropriate safeguards are still needed, as a rule standard contractual clauses with the adaptations for Switzerland (Art. 16 para. 2 let. d FADP).
Source: Official Journal of the EU, Implementing Decision (EU) 2026/179. General information summarised from the source, not advice on your case: for your case, the text of the decision or the law is what counts.