The law defines data processing as those systematic operations and procedures, automated or not, that allow the collection, registration, recording, conservation, ordering, storage, modification, updating, evaluation, blocking, destruction, deletion, use and cancellation, as well as the transfer of personal data resulting from communications, consultations, interconnections and transfers. 

Personal data may only be processed, when they are adequate, proportional and necessary in relation to the scope and specific, explicit and legitimate purposes for which they have been requested. 

The purpose of processing the personal data of the user should be to facilitate the improvement, expansion, sale, billing, management, provision of services and acquisition of goods.