The concept

The Lei Geral de Proteção de Dados (LGPD) regulates the handling of personal data in Brazil. In payments, it covers everything the checkout collects: name, email, phone, ID document, and address.

In practice, the seller needs to state what each piece of data is used for, keep only what's necessary, allow the buyer to request deletion, and not pass the database on to third parties without a legal basis.

Card data has its own, stricter rule, set by PCI-DSS: it shouldn't even pass through your server.

How it shows up in practice

You collect email, phone and address from your buyers to send exclusive content later. A buyer asks you to delete all their data from your database. You must delete and can't keep anything beyond what is strictly necessary for product delivery and invoicing.

The aim of marketing is to know and understand the customer so well the product or service fits him and sells itself.

Peter Drucker Source: Management: Tasks, Responsibilities, Practices.

LGPD regulates how you use personal data in Brazil. You need to state what you use each piece of data for, keep only what's necessary, allow deletion, and not share the database without permission. Card data has even stricter rules and shouldn't even pass through your server. Non-compliance means heavy fines and legal action.