Brazil's General Data Protection Law governs the handling of personal data, including payment information. Legal bases, transparency and rights sit alongside security, governance and cross-border processing controls, with qualifying incidents reported to ANPD and affected people.
TL;DR:
- Personal-data processing needs a lawful basis, transparency and safeguards.
- Individuals' rights, cross-border processing and qualifying incident reporting are covered.
- Consent is one possible legal basis; roles and processing purposes determine the requirements.
Summary
A framework for personal-data processing
Brazil's Lei Geral de Proteção de Dados Pessoais, Law No. 13,709/2018, governs the processing of individuals' personal data by public and private actors within its scope. The LGPD addresses the legal conditions for using data and safeguards against inappropriate use. Payment information can fall within that framework when it identifies a person, alongside account, identity, device and customer-service information.
Lawful use and individual rights
Controllers must identify a lawful basis for processing, provide transparency and respect the rights the law gives to data subjects. ANPD identifies rights including confirmation of processing, access, correction, information about sharing, withdrawal of consent where relevant and review of solely automated decisions affecting the individual. A permitted payment purpose does not remove the need to assess the data used for other purposes. The same data may support payment execution and a separate fraud or marketing purpose, each requiring its own assessment.
Security, governance and incidents
The framework connects accountability and appropriate security measures with evidence of how processing is organised. It also addresses qualifying incidents and communications to ANPD and affected individuals. For payment operations, the responsible parties need to understand who determines the use of data and who processes it for another party; allocating a technical function to a supplier does not erase the underlying governance relationship.
Application across the payment chain
The LGPD can be relevant to onboarding, payment execution, authentication, fraud controls and support when those activities involve personal data. Its cross-border and territorial provisions must be considered where processing or service providers span jurisdictions. The applicable legal basis, individual rights, security duties and transfer conditions are separate questions; consent should not be presented as the only possible basis for every payment-related use of data.
Keywords
- LGPD
- Brazil privacy
- lawful processing
- data rights
- ANPD
- security incidents
- international transfers
- controller duties
- purpose limitation
- payment information