On 5 November 2026, the UK's Department for Digital, Culture, Media and Sport (DCMS) and Brazil's data protection authority (ANPD) published a joint statement on exploring international data transfer arrangements. The two bodies said they welcomed "steady progress" in their respective assessments and would continue technical engagement in the coming months. They also said each country will decide any future arrangement independently, under its own legal requirements.
The statement is not an adequacy decision. It sets no decision date and names no legal instrument. Read carefully, it is a signal of intent from two regulators, and it changes nothing in the law yet.
The case for caution
The sceptics' strongest argument deserves a fair hearing. Adequacy is not a courtesy. It is a judgment that another country's legal system protects personal data to a comparable standard, and that judgment has to survive scrutiny. As the IAPP notes, adequacy "does not, by itself, make the underlying processing compliant." Regulators who move slowly are protecting citizens from transfers that could later be struck down. A rushed instrument that collapses in court would leave businesses worse off than a slow one that holds.
That is why the joint statement's language about independent legal procedures is not boilerplate. Each side is saying it will not outsource its judgment.
What the EU–Brazil precedent shows
The statement follows the January 2026 EU–Brazil decisions, and the contrast with them is informative. The European Commission's adequacy decisions page lists Brazil among recognised countries, with its decision dated 26 January 2026. The Commission announced the mutual decisions on 27 January. White & Case's analysis records that ANPD adopted Resolution CD/ANPD No. 32/2026 on 27 January, and that the EDPB had issued its Opinion 28/2025 on 4 November 2025.
The EU route had visible milestones: a formal Commission decision, a named EDPB opinion, a reciprocal Brazilian resolution, and a review clause. Both sides are to review their decisions within four years. Covington reports that the Commission launched the process on 5 September 2025, so the path from launch to adoption took roughly four and a half months.
The UK–Brazil statement has none of those markers. There is no launch of a formal procedure, no named instrument, and no timetable. That does not make it meaningless. It does mean no compliance team should treat it as a future adequacy finding.
Why the vagueness has a cost
The argument for proportionate regulation is not that regulators should skip diligence. It is that uncertainty is itself a cost, and regulators can reduce it cheaply.
The EU precedent shows what a settled framework delivers. Personal data can flow between the EEA and Brazil without restriction, with no standard contractual clauses or other transfer safeguards needed. Under LGPD Article 33, IAPP explains, once a destination is recognised as adequate, no other Article 33 mechanism is required. For a UK start-up serving Brazilian customers, or a Brazilian fintech running analytics in London, that difference is concrete. It means fewer contracts to negotiate, fewer transfer risk assessments to maintain, and fewer reasons for a small firm to avoid the market.
Until an arrangement exists, those firms stay on existing contractual tools. The statement gives them nothing to change today, and it gives them nothing to budget around. A reasonable middle path is available. Regulators can keep their independence and still publish an indicative timeline, say what the assessment covers, or name the instrument they are considering. None of that prejudges the outcome.
The wider ANPD workload
There is a plausible reason for ANPD's pace. The agency is carrying a heavy and growing load. The EFF reports that ANPD "plays a pivotal role in the regulation of digital platforms" under new Brazilian legislation. It is responsible for detailing and applying the obligations of Law No. 15.211/2025 on children and adolescents online, including age assurance, and it has a "critical regulatory role" on intermediary liability after the Supreme Court decision and presidential decrees changed that regime.
This is a capacity argument, and it is a fair one. An authority asked to supervise platforms, protect minors and negotiate international transfers at once will have to prioritise. The risk is that cross-border transfers, which are low-drama and high-value, get queued behind more politically visible work. For a pro-innovation reader, that is the thing to watch. Data-flow arrangements are infrastructure, and infrastructure rarely generates headlines until it is missing.
What to watch
Three signals would turn this statement into something actionable:
- A named instrument. Does the UK use its adequacy powers, or a narrower arrangement? Does ANPD adopt a resolution like the one that recognised the EU?
- A published timetable. Even an indicative window would let firms plan.
- Reciprocity. The EU–Brazil decisions run both ways. The joint statement says each country decides independently, so it is worth watching whether the two sides converge on mutual recognition or move at different speeds.
Until then, the practical advice is unglamorous. Keep existing transfer mechanisms in place, and do not assume a future adequacy finding when drafting long-term contracts. The EU precedent is encouraging, because it shows that Brazil's framework can clear a demanding review. But a precedent from a different partner, under a different legal regime, is not a decision.
Bottom line
Two regulators saying they are making progress is better than two regulators saying nothing. It is not the same as a pathway. The sensible response is to welcome the dialogue, avoid reading it as a promise, and press both agencies for the one thing that would make it useful: a date and a named instrument.