UK and Brazil Are Talking About Data-Transfer Arrangements. That Is Not an Adequacy Decision

On November 5, 2026, the United Kingdom and Brazil published a joint statement that sounded bigger than it is. The UK Department for Digital, Culture, Media and Sport and Brazil’s Autoridade Nacional de Proteção de Dados said they are exploring possible international data-transfer arrangements and will keep talking. They did not announce an adequacy decision, a mutual recognition pact, or a finished legal mechanism that companies can rely on tomorrow. Each side stressed that any future arrangement would be decided independently under its own law.

What the joint statement actually says

The English text on GOV.UK is short and careful. It opens by confirming that the United Kingdom and Brazil are in dialogue “with a view to exploring the possibility of international data transfers arrangements.” Both governments reaffirmed a shared interest in free flows of data alongside high standards of personal-data protection, and they pointed to economic growth, innovation, public services, scientific research, and international cooperation as reasons the work matters.

The operative sentences are the ones that limit expectations. Both sides “welcomed the steady progress made in their respective assessments and ongoing discussions” and agreed to continue technical engagement in the coming months. Then the line compliance teams should highlight: “Each country will determine any future arrangements independently and in accordance with its own legal requirements and procedures.” That language is the opposite of a finished deal. It means two parallel processes that might, later, produce compatible outcomes—or might not.

Stephanie Peacock, Minister of State in the Department for Digital, Culture, Media and Sport, said she valued collaboration with Brazil on data and the constructive discussions as both countries explore international data-transfer arrangements. Waldemar Gonçalves Ortunho Junior, then Director-President of ANPD, said Brazil and the United Kingdom share a commitment to international cooperation on data protection and trusted cross-border flows, and that ANPD remains committed to advancing its assessment under Brazil’s legal framework. ANPD’s Portuguese release noted that Ortunho’s mandate ended on that Thursday, so the dialogue outlasts any single officeholder.

The joint statement on GOV.UK and ANPD’s matching notice are the primary texts. Neither document names a target date for a decision, lists sectors that would be covered, or describes the legal instrument under consideration.

Why Brazil–EU adequacy matters as context—and why it is not this story

In January 2026 the European Commission and Brazil adopted mutual adequacy decisions, confirming that each side’s data-protection level is comparable for the purpose of those decisions. The Commission’s press release dated January 27, 2026 framed the outcome as allowing personal data to flow between the EU and Brazil without additional transfer tools, covering a combined consumer base of about 670 million people, and described the decisions as unilateral, independent acts adopted in a coordinated way. The Commission said it would review the functioning of its decision after four years.

That history explains why a UK–Brazil conversation attracts attention. Brazil already sits inside a large free-flow zone with the EU. The UK, after Brexit, runs its own UK GDPR and has its own adequacy relationships. A UK–Brazil arrangement would close a different commercial gap: UK-based controllers and processors dealing with Brazilian affiliates, vendors, research partners, and cloud regions, and Brazilian organizations sending personal data to the UK. It would not automatically rewrite the EU–Brazil path, and it does not mean UK transfers to Brazil are now “adequate.”

Readers tracking the broader map of global adequacy updates for data flows should treat the November statement as a process milestone, not a green light. The January EU–Brazil package is better understood through the earlier coverage of the EU and Brazil digital partnership than through today’s talking points.

How UK and Brazilian transfer rules still work while talks continue

Until either jurisdiction adopts a specific arrangement for the other, the ordinary transfer rules apply.

On the UK side, personal data leaving the UK needs a lawful transfer mechanism under the UK GDPR. Where the destination is not covered by a UK adequacy regulation, organizations typically look to the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, binding corporate rules, or other permitted tools, often with a transfer risk assessment. The Information Commissioner’s Office has published interactive guidance that many teams already use when they map destinations; that material remains relevant while the Brazil dialogue proceeds.

On the Brazilian side, the Lei Geral de Proteção de Dados (LGPD) allows international transfers when the destination offers an adequate level of protection recognized by ANPD, or when another lawful mechanism applies—standard contractual clauses approved by ANPD, specific contractual clauses, binding corporate rules, specific consent, or other grounds set out in the statute and ANPD regulations. Adequacy under LGPD is an ANPD instrument, not an automatic copy of whatever the UK decides.

A side-by-side reading of GDPR, CCPA, and LGPD still helps counsel explain to boards why “we already talk to Brazil” is not the same as “we have a transfer basis.” Other Latin American regulators have been busy on transfer tooling of their own; Colombia’s recent model clauses are one example of how the region is filling gaps with contractual clauses for international data transfers rather than waiting for every bilateral adequacy file to finish.

A five-step checklist while the dialogue runs

Compliance teams do not need to rewrite their Brazil playbooks because of a joint statement. They do need to keep documentation honest about what has and has not changed.

1. Inventory UK–Brazil personal-data flows. List systems, vendors, research collaborations, HR, customer support, and cloud regions that move personal data between the two jurisdictions. Note volume, categories, and whether data subjects are in the UK, Brazil, or both.
2. Confirm the current transfer basis for each flow. For UK exports, record whether you rely on the IDTA, the UK Addendum, BCRs, or another tool, and keep the matching transfer risk assessment. For Brazilian exports, record the LGPD article and any ANPD-approved clause set in use.
3. Separate “EU–Brazil adequacy” from “UK–Brazil talks.” If a flow is EU–Brazil, the January 2026 mutual decisions may already remove the need for SCCs on that leg. If the flow is UK–Brazil, those decisions do not answer the question.
4. Watch for ANPD and UK instruments, not press headlines. An arrangement that matters for operations will appear as a formal adequacy regulation, ANPD decision, or approved clause set—not as another joint communiqué.
5. Use existing ICO transfer tooling while you wait. The Commissioner’s interactive transfer materials remain a practical way to pressure-test destinations; see the overview of the ICO’s interactive tool for international data transfers when refreshing assessments.

Also keep an eye on regulator-to-regulator cooperation that sits beside adequacy. ANPD has pointed to a September 2025 memorandum of understanding with the UK Information Commissioner’s Office, signed around the Global Privacy Assembly in Seoul, covering mutual cooperation on digital governance and personal-data protection. MoUs help investigations and knowledge-sharing. They are not transfer authorizations.

Frequently asked questions

Did the UK and Brazil adopt an adequacy decision on November 5, 2026?

No. They announced ongoing dialogue and further technical engagement. Each country said it would decide any future arrangement under its own procedures.

Does the EU–Brazil adequacy from January 2026 cover UK transfers?

No. Those mutual decisions address flows between the EU (and EEA, as applicable) and Brazil. The UK operates under UK GDPR and would need its own arrangement or another lawful transfer tool for UK–Brazil exports.

Which UK department is leading the talks?

The joint statement published on GOV.UK attributes the dialogue to the Department for Digital, Culture, Media and Sport (DCMS) and quotes Stephanie Peacock as Minister of State in that department. Use the naming in the official statement when you cite it.

What should a company put in its transfer register today?

Keep the current mechanism (IDTA, SCCs/Addendum, ANPD clauses, BCRs, or other lawful ground) and note that UK–Brazil adequacy talks are underway but incomplete. Do not mark Brazil as “adequate for UK exports” until a UK instrument says so.

Talks are progress. They are not a transfer basis.

Joint statements of this kind usually mean two things at once: the political relationship is warm enough to keep assessing, and the lawyers still have months of work before anyone can delete a contract clause. Companies that treat November 5 as permission to stop using the IDTA or ANPD mechanisms will invent a risk the statement never created. Companies that treat it as a calendar reminder—update the Brazil row in the transfer map, assign an owner to watch for a real instrument, and keep the existing paperwork current—will be ready if and when either side actually decides.