Brazilian data-protection framework governing legal bases, rights, security, governance and cross-border processing. Its scope covers personal data used in payment and financial services.

The main requirements are to use a legal basis, provide transparency, support rights and implement security and governance measures.

Personal-data protection follows information through collection, use, storage, sharing and deletion. The organisation deciding the purpose of processing can have different responsibilities from a supplier processing information on its behalf. Identifying those roles makes it possible to connect notices, permissions, contracts and security controls to the actual handling of customer and transaction data.

The practical questions are what information is needed, why it is used, who receives it, how long it is retained and how individuals can exercise the rights available under the relevant framework. Payment execution, financial-crime prevention, legal record keeping and optional marketing are different purposes. A basis for one purpose should not be treated as unlimited permission for every other use.

Security and privacy overlap but are not identical. Preventing unauthorised access does not alone answer whether an authorised use is lawful, while a privacy notice does not replace effective access control or incident response. Cross-border processing and outsourced services add further relationships that need to be understood within the instrument's territorial and substantive scope.

The instrument also addresses reporting and evidence: keep processing evidence and communicate qualifying incidents to ANPD and data subjects.