The financial institution must develop appropriate mechanisms according to the relevant applicable regulations, instructions and policies to protect the privacy of consumers’ financial, credit, insurance and/or personal information, provided that these mechanisms include all rights mentioned in the Personal Data Protection Law. The financial institution must also establish high-level control systems that include appropriate mechanisms specifying the purposes for which data is collected.