Company: BBD
Filing Date: 2025-03-31
Form Type: 20-F
Source: 0001292814-25-001244
Chunk: 68

Company: BANK BRADESCO
Filing Date: 2025-03-31
Form: 20-F
Item: Item 3
Chunk 68
---
 risk is represented by the possibility of cyber incidents, such as attacks, intrusions and leakages, that could compromise the confidentiality, integrity and/or availability of our critical business processes, assets and/or infrastructure.
 
3.D.20.09-01 Failure to adequately protect ourselves against risks relating to cybersecurity could materially and adversely affect us.
 We are exposed to failures, deficiencies or inadequacies in our internal processes, systems and processes of our service providers, human error or misconduct, as well as cyberattacks. Although we have procedures and controls to safeguard our information technology systems and platforms, we are subject to cybersecurity risks that could materially and adversely affect us in case of failures to adequately protect our assets and people or the assets and people of our service providers.
 Like other large corporations, we are heavily dependent on innovation and technology, which exposes us to internal and external events that may affect the availability of our systems and information technology infrastructure. Those events can also occur at our service providers, which form part of our supply chain and have the potential to materially adversely affect our business and activities.
 The risks that may, directly or indirectly, impact us or our service providers, include, but are not limited to: intrusion into information technology systems and platforms by malicious individuals, infiltration of malware (such as computer viruses) into our systems, intentional or accidental contamination of our networks and systems or those of our service providers with whom we exchange data, unauthorized access to confidential client data and/or organizational data and cyberattacks with the potential to cause service degradation and/or outages that can result in business losses.
 Cybersecurity and its associated risks are treated at the highest strategic level of priority. We account for the potential loss, theft, or modification of data processed and stored by us, as well as by our service providers. These considerations are essential for our risk analysis, in light of the potential for exploiting vulnerabilities and weaknesses in both our, and our service providers’, information technology environments (such as ransomware attacks).
 Our corporate security department carries out a prior and periodic analysis of the security controls in the environment of our service providers. Our contracts for relevant data processing and storage and cloud computing services contain specific cybersecurity clauses aimed at protecting the information, even after termination of the contract.
 Brazilian regulatory bodies have also intensified regulations, including through the LGPD, CVM Resolution No. 35/21, CMN Resolution No. 4,893/21 and BCB Resolution No. 85/21 improving controls, policies and requirements for cloud services.
 The LGPD imposes sanctions and fines in