Company: BBD
Filing Date: 2025-03-31
Form Type: 20-F
Source: 0001292814-25-001244
Chunk: 334

Company: BANK BRADESCO
Filing Date: 2025-03-31
Form: 20-F
Item: Item 16
Chunk 334
---
/TF. We highlight the main areas and activities:

• Governance of Information Security (IS) Policy and Guidelines: its mission is to develop, maintain
and manage the Policy and Corporate Standards of Information Security, Privacy and Data Protection and Cybersecurity applicable to our
business, adhering to what we believe are best practices. It also has the responsibility to evaluate and approve specific standards and
rules, related to Information Security and which have been developed by all Departments and Subsidiaries;

• Management of Privacy and Data Protection: responsible for managing the Privacy Program, ensuring
the privacy of personal data collected and processed. Responsible for controls and processes aiming to maintain the our privacy governance
structure and our compliance with the General Data Protection Law (LGPD) and other regulatory standards, as well as providing services
to data subjects and the demands of the National Data Protection Authority (ANPD), in addition to monitoring the evolution of the theme
in the legislative and judicial scenarios;

• Cryptographic Keys and Digital Certification: it has the mission, respectively, to carry out governance
and generate symmetrical cryptographic keys, and to provide support to the theme certification/digital signature, to coordinate the issuance
of ICP-Brasil digital certificates for systemic and employee use;

  235 – Form 20-F 2024 | Bradesco  

  Table of Contents  

• Compliance
and Risk Management: its mission is to identify and evaluate risks related to Information Security and Cybernetics, depending on
preferred the corporate risk methodology, considering, among others, elements such as information assets, data criticality, threats
and vulnerabilities, risk scenarios and controls established in market frameworks, and internal, legal and inflexible rules, with
the aim of assisting the business in risk mitigation. It also acts as a focal point along with the Compliance and Non-Financial Risk
Management Department, to confirm the information security and cyber risk, new or existing, inserted in the library or in the
corporate risk map, triggering technical experts, when necessary.

Additionally, provide
subsidies related to Information Security for compliance with audits, regulatory bodies and internal and external entities;

• Cybersecurity
Management: its mission is to operate as the first line for Cybersecurity in Corporate Security, by managing the Framework for the Corporate Security, which establishes and monitors the integrated vision; consolidate and report on the metrics of performance and risk related to information and cybersecurity; and inform the appropriate committees of these risks and threats. It operates in the following spheres: data leakage monitoring,