The company should replace that assurance with a direction-specific transfer schedule. Reciprocal adequacy can remove the need for transfer safeguards on covered EU-Brazil flows. The US API, support access and provider reuse need separate treatment. The recommended initial service permits defined inference and support, with independent model training excluded until separately assessed.
- EU-to-Brazil transfers can rely on Decision 2026/179 when the receiving controller or processor is subject to Brazil’s General Personal Data Protection Law (LGPD). Brazil-to-covered-Europe transfers have a separate adequacy basis issued by Brazil’s National Data Protection Authority (ANPD). Neither direction requires standard contractual clauses (SCCs) solely because the data cross that border. (GDPR, Art 45; Decision 2026/179, Art 1; ANPD Resolution 32/2026, Art 1.)
- For the continuing Brazil-to-US service, use ANPD standard clauses unless another Brazilian transfer mechanism actually applies. A US provider’s EU certification does not establish that Brazilian mechanism. (LGPD, Arts 33–35; ANPD Resolution 19/2024, Annex I, Arts 9 and 15–20.)
- Retain processing instructions, subprocessor controls, security, rights assistance and deletion terms. Assess independent provider use under its actual purpose and role. (GDPR, Arts 4(7)–(8), 5–6 and 28; LGPD, Arts 5–7, 11 and 39.)
What reciprocal adequacy covers
EU to Brazil
Commission Implementing Decision (EU) 2026/179 took effect on notification on 26 January 2026. It was published on 28 January. Article 1 covers personal data transferred from the EU to Brazilian controllers and processors subject to the LGPD. Procurement should record the receiving entity and why its processing falls within that law. The decision supplies the GDPR Article 45 route for a covered transfer.
That removes the need for Article 46 safeguards for the same leg, including transfer SCCs and an SCC-based assessment of Brazilian law. The customer must still select a suitable processor and establish lawful processing. Adequacy decisions also remain subject to monitoring, amendment, suspension or repeal. (Decision 2026/179, Arts 1–4; GDPR, Arts 28 and 45.)
Brazil to Europe
ANPD Resolution 32/2026 took effect on publication on 27 January 2026. It covers EU Member States, Iceland, Liechtenstein and Norway, and EU institutions, bodies and agencies. Its exception concerns transfers exclusively for public security, national defence, state security or criminal investigation and enforcement. A commercial fraud-control service should not be classified as public-authority criminal enforcement merely because it detects suspected fraud. (Resolution 32/2026, Arts 1–2 and 6.)
For covered transfers, the fintech can rely on LGPD Article 33(I), including when returning information to an EU customer. Adequacy does not remove the LGPD’s processing requirements. The ANPD regulation’s narrow exception for foreign data returned exclusively to their origin requires an express exception in the adequacy decision. Resolution 32 contains none. Sending those data onward to the US also defeats an exclusive-return premise. (LGPD, Arts 3–4; Resolution 19/2024, Annex I, Arts 7–9.)
Map roles and access before selecting clauses
Where the EU customer determines the purposes and means of processing its customer records, it is the controller. The fintech is a processor for operations performed on that customer’s instructions. Its model and support suppliers can be subprocessors for those operations. The fintech may separately control its own customer relationships, compliance records or other purposes. Contract labels should follow those activities. (GDPR, Arts 4(7)–(8) and 28; LGPD, Art 5(VI)–(VII).)
Selling to an EU business does not automatically make every operation of the Brazilian supplier directly subject to the GDPR. Article 3 requires a separate territorial assessment. The EU customer’s duties and Article 28 contract remain relevant even where the supplier falls outside that direct scope. Conversely, data collected in Brazil can retain an LGPD connection after being routed through Europe. Record the applicable law per operation rather than treating nationality as the test. (GDPR, Art 3; LGPD, Art 3; EDPB Guidelines 3/2018, section 1(d)(i), pp 10–11.)
Map prompts, retrieved records, outputs, logs, backups and human support access. Disclosure to a separate foreign company can constitute a transfer even when servers remain in Europe or Brazil. Another group company is a separate recipient; shared branding does not settle its permissions. (EDPB Guidelines 05/2021, version 2, paras 9, 16 and 21 and Example 9; Resolution 19/2024, Annex I, Art 3(III).)
A mixed data pool needs evidence for each applicable regime. Pseudonymisation should not be treated as proof that prompts are anonymous. The separate assessment of generated datasets is addressed in Brazilian synthetic data for an Irish bank. (GDPR, Art 4(5) and recital 26; LGPD, Art 12.)
The US model and offshore support transfers
Establish the Brazilian route
The EU and Brazilian adequacy decisions do not extend their destination coverage to the US. For an ongoing US API relationship within the LGPD, the recommended contractual route is ANPD’s standard clauses, unless the facts establish another Article 33 mechanism. As at 6 November 2026, the ANPD’s register identifies no recognised equivalent foreign SCCs. EU SCCs alone therefore cannot be presented as the Brazilian solution. (LGPD, Arts 33–35; Resolution 19/2024, Annex I, Arts 9 and 15–20.)
Adopt the ANPD text in full and unchanged, completing its designated fields and permitted additions. Identify the exporter, importer, purposes, data categories, retention and security measures. If both the fintech and the model provider act exclusively as processors, Clause 4 Option B requires identification of the third-party controller and its written instructions. Use the appropriate controller configuration for the fintech’s separate controller activities. (Resolution 19/2024, Annex I, Art 16; Annex II, Clauses 1–5.)
For later disclosures by an importer using those clauses, complete Clause 3 and apply Clause 18. Clause 18.3 permits another valid Brazilian transfer mechanism independently of Clause 3 authorisation. Clause 18.2 still requires compatible purposes, written downstream safeguards and importer responsibility. These clauses attach through their adoption; they do not automatically govern every recipient that originally received data under adequacy.
The offshore support vendor needs the same entity, country and purpose analysis. Until its location is identified, no particular route can be approved. If a relevant recipient or transfer cannot be verified, keep that access disabled until the missing conditions are satisfied.
Establish any additional EU route
The EU customer remains responsible for sufficient guarantees under Article 28, including onward processing from Brazil. The European Data Protection Board (EDPB) distinguishes that duty from independently reassessing an adequate country’s onward-transfer rules, which the Commission already assessed. Its Opinion 22/2024 is supervisory interpretation, not a separate binding transfer instrument. (GDPR, Arts 28(1) and 45(2)(a); EDPB Opinion 22/2024, paras 93–95.)
If the Brazilian exporter is itself subject to the GDPR for the relevant processing, its own Chapter V duties also apply. Direct EU disclosures to the US require their own route. Assess the EU-US Data Privacy Framework (DPF) only where the actual transfer, recipient and data fall within its coverage. Decision 2023/1795 concerns transfers from the Union to listed US organisations. A purely Brazilian data flow cannot be cleared merely by finding a DPF logo. (GDPR, Arts 3 and 44–46; Decision 2023/1795, Art 1.)
Where DPF coverage applies, additional EU SCCs are unnecessary for that covered transfer. Otherwise, identify an available Article 46 safeguard. The 2021 SCCs require a GDPR-subject exporter and an importer whose relevant processing is outside the GDPR’s direct scope. Select the module by the parties’ actual roles and complete the destination-law assessment and any necessary supplementary measures. If that SCC scope does not fit, resolve another valid route before access begins. (Decision 2021/914, Art 1 and recital 7; Annex, Clauses 8, 14–16.)
Independent model use needs its own permission
The initial agreement should confine customer-content processing to specified service functions. Disable independent training or product improvement by contract and configuration pending a separate assessment. This is the recommended product boundary; training is not categorically prohibited.
A provider that determines the purposes and means of its own training must be assessed as a controller for that activity. Each relevant controller must justify its processing, including disclosure, purpose compatibility and transparency. Sensitive data need the applicable additional condition. A business-to-business improvement licence supplies neither data-subject consent nor a universal lawful basis. (GDPR, Arts 4(7), 5–6, 9, 13–14 and 28(10); LGPD, Arts 5(VI), 6–11.)
Check whether safety review, abuse monitoring, feedback or retained logs involve independent purposes. A no-training setting answers only part of that inquiry. The broader allocation of roles is explained in Personal Data Processing by AI under EU Law.
Simplify the contracts without losing required safeguards
Use one customer agreement with an Article 28 processing schedule, an accurate subprocessor list and a direction-specific transfer schedule. Attach the necessary vendor transfer instruments to the relevant vendor agreements. Keep shared descriptions of the data and security controls consistent across the documents.
For covered EU-Brazil legs, remove provisions whose sole purpose is supplying an unnecessary transfer mechanism. Use the agreement’s amendment procedure or, where its conditions are met, the 2021 SCCs’ Clause 16(e) revocation right. Check continuing duties and accrued rights relating to earlier transfers. If existing SCC modules also supply Article 28 terms, preserve those duties in a complete processing schedule before removing the clauses. (GDPR, Arts 28 and 45; Decision 2021/914, Art 1(2) and Annex, Clause 16(e).)
Retain documented instructions, confidentiality, security, incident assistance, rights assistance, deletion or return, and compliance evidence and audit rights. The processor must obtain prior specific or general written authorisation for subprocessors. General authorisation requires notice of intended additions or replacements and an opportunity to object. The initial processor remains liable to the controller for its subprocessor’s performance. (GDPR, Art 28(2)–(4).)
Under the ANPD clause route, allocate the required Portuguese transfer disclosures and response process to the responsible controller. Preserve applicable onward-transfer, government-access, security and destination-law duties. An English master agreement should not displace the clauses’ Brazilian-law and dispute provisions. (Resolution 19/2024, Annex I, Art 17; Annex II, Clauses 4, 14 and 18–24.)
Any sector-specific outsourcing terms also need their own applicability check. An EU customer within the scope of the Digital Operational Resilience Act retains the relevant information and communication technology contract requirements despite adequacy. Its regulated status and the function supported determine the additional terms. (Regulation (EU) 2022/2554, Arts 2, 28 and 30.)
The data-flow records, processing terms and transfer schedules should form one consistent set within Data Protection and GDPR for AI preparation.
Subprocessor verification and change control
Before approving a supplier, procurement and the privacy lead should obtain:
- The exact contracting and receiving entities, registered addresses, processing roles, and every hosting or access country.
- The permitted operations and data categories, including sensitive information, prompts, logs, outputs and retention periods.
- For DPF reliance, the active EU-US listing and coverage of the receiving entity, relevant subsidiary and data category. UK or Swiss participation alone does not establish EU-US coverage.
- The applicable Brazilian mechanism and any separate EU mechanism, with completed schedules and supported security commitments.
- The downstream supplier list, written instructions, reuse restrictions, deletion arrangements and evidence needed to assess sufficient guarantees.
Entity and certification checks follow the actual recipient and processing, including any change to another group company. (Decision 2023/1795, Art 1 and Annex I, section III.6; GDPR, Art 28; Resolution 19/2024, Annex II, Clauses 1–4 and 18.)
The contract should require advance notice of changes to recipients, countries, purposes and retention. Give the customer enough information and time to exercise its applicable authorisation or objection rights before access changes. Define suspension, replacement and exit arrangements where required safeguards fail. Engineering should implement the approved restrictions in routing, credentials and API settings. A legal approval that leaves broader access enabled does not implement the agreed service.
Before enabling access
First, the fintech and EU customer should agree the data-flow and role map. Next, legal and procurement should record adequacy for each covered bilateral leg and complete the US and support-provider arrangements. The responsible controllers should settle lawful bases, notices and any required impact assessment. Engineering should then test the agreed access, reuse, retention and deletion controls. Keep the transfer schedule current when a supplier or applicable decision changes. (GDPR, Arts 5(2), 28, 32 and 35; LGPD, Arts 6, 37–39 and 46.)
Plan the transfer review
For a review of a Brazil-EU AI data supply chain, contact Licentium with the data-flow map, customer processing terms, model-provider terms and support-vendor list.