How is your organisation adapting to the rapid evolution of data protection, AI governance and cybersecurity requirements in Brazil?

Telefônica Brasil (Vivo) continuously monitors, in an integrated manner with the technical and legal areas, regulatory developments in privacy, AI and cybersecurity, from the LGPD to the AI Legal Framework (PL 2.338/23). Vivo’s Privacy Governance Program, which follows the guidelines of the Telefónica Group, is robust, mature and aligned with market best practices. It includes, in addition to the formal record of processing activities, impact assessments, risk analyses, and the application of security and privacy by design.

Data protection is embedded in the Responsible Business Principles (Code of Ethics and Conduct), with reporting to the Board of Directors on the performance of Corporate Security and the DPO. Transparency is reinforced by the Privacy Center, the updated Privacy Notice, and the culture disseminated internally through mandatory training (over 89%), campaigns, and workshops. Since 2018, the Telefónica Group has followed AI governance principles focused on transparency, fairness, and data protection. The company also operates in digital security based on the Global Policy and a long-term Master Plan, aligned with globally recognized standards such as ISO 22301, NIST, PCI DSS and MDR, in addition to requirements applied to suppliers and ISO 27001 certification.

How is your organisation adapting to the rapid evolution of data protection, AI governance and cybersecurity requirements in Brazil?

VIVO’s legal team has adopted a series of integrated strategies to enhance efficiency, mitigate risk, and better align with business objectives. A multidisciplinary committee meets regularly to address the main sources of litigation and administrative proceedings, enabling the rapid identification of root causes and the implementation of targeted internal and external responses.

The team has also invested in automation and technological tools, allowing for the capture, classification, and management of claims based on pre-established criteria. Through a robust case management system and internal integrations, information can be accessed and directed more effectively, enabling business areas to respond with greater precision and speed.

An innovative working model has been introduced for selected matters, dividing the defence process into two stages. An initial defence is prepared by one law firm, followed by representation by another firm using the draft already developed, increasing both efficiency and consistency in legal arguments.

Artificial intelligence is also being used to organise documentation and strengthen evidentiary support in consumer disputes, including verifying the authenticity of signatures in representation documents. Alongside this, the team maintains a strong focus on reducing new claims, which has led to a significant decrease in overall case volume, while also actively discouraging abusive litigation practices.

Operational improvements have been made in handling Procon-related matters, reducing new filings and resolving existing cases without penalties. Additional initiatives target the reduction of disputes in civil liability and urban-environmental law.

Legal is closely involved in decision-making from early, preventive stages, ensuring agile, consistent, and commercially aligned advice. The team’s diverse composition further strengthens critical thinking and problem-solving capabilities.