Company: BBD
Filing Date: 2025-05-30
Form Type: 6-K
Source: 0001292814-25-002283
Chunk: 131

Company: BANK BRADESCO
Filing Date: 2025-05-30
Form: 6-K
Chunk 131
---
We face additional risks related to:

•
the need for continuous redesign and development of our information technology architecture and applications;

•
the need to upgrade and integrate legacy systems with emerging technology models in a timely manner;

•
the increasing dependence of service providers due to the migration of certain services to the cloud, which demands robust governance
and new ways of mitigating security and continuity risks beyond our control environment;

•
the broad use of internet solutions, artificial intelligence and connectivity; and

•
the growing difficulty in attracting and retaining IT specialized personnel in a competitive market.

Considering
the use of new technologies, the increasing reliance on the internet, and the ever-evolving and sophisticated nature of cyberattacks,
it is not possible to predict all the means that will be employed by malicious individuals or organizations, which could impact our ability
to effectively anticipate and/or prevent cyberattacks. Any of these events or any new factors can cause disruptions, increased costs,
delays in information processing,
and/or losses in the transmission of essential data, which can affect our business, reputation, and operational and financial conditions.

| 111 – Reference Form – 2024 |

| 4. Risk factors |

We may incur penalties in case of non-compliance with data protection laws.

In August
2018, Law No. 13,709/18 – General Data Protection Law (LGPD, in Portuguese) was enacted, which creates a set of rules for the use,
protection and transfer of personal data in Brazil, in the private and public spheres, and establishes responsibilities and penalties
to agents who process personal data. In addition to including existing rules on the subject, the LGPD followed the global trend of strengthening
the protection of personal data, restricting its unjustified use, and guaranteeing a series of rights to holders of data, as well as imposing
important obligations on so-called “treatment agents”. In particular, the LGPD was inspired by recent European legislation
on the subject, reproducing central points of the Directive No. 95/46/EC, Regulation 2016/679 (UE) and General Data Protection Regulation
(GDPR).

The
impact of this law has been significant as any processing of personal data will be subject to the rules imposed by LGPD, whether physical
or digital, by any entity established or not in Brazil, any entity who has collected personal data in Brazil, any individual located in
Brazil – even if not residents – or any entity that offers goods and services to Brazilian consumers. In short