Data privacy at Telefónica: innovation, digital transparency and commitment

In a world where personal data is a strategic asset and digital trust has become an essential value, Telefónica has consolidated an exemplary model of privacy management. Technology improves people’s quality of life and creates wealth, as long as privacy is respected and the highest levels of security are maintained in all the processing of personal information and data.

Through the Global Transparency Center, you will be able to learn first-hand how the company deploys a robust, transversal and committed architecture, which integrates principles, policies and tools aimed at safeguarding users’ rights and complying with the most demanding privacy regulations, such as the General Data Protection Regulation (GDPR).

Vision and governance that shape data privacy at Telefónica 

Data privacy at Telefónica is based on a clear vision: to offer users digital products and services with the highest standards of security, respect and control over their personal information. This vision is underpinned by principles such the protection of personal data, user empowerment, privacy by design and by default and transparency. 

Specifically, these principles translate into protecting personal data through robust policies and processes; providing individuals with autonomy and full control over their data; embedding privacy from the outset and throughout the entire lifecycle of products and services; and transparently explaining how and why personal data is collected, used, stored, and deleted. The company also works to promote the management of personal information in a manner that is increasingly transparent, understandable, and accessible to users.

From a solid governance structure, Telefónica articulates this vision through an organizational model where the Group’s Data Protection Officer (DPO) plays a key role in advising, supervising and accompanying data protection, ensuring compliance with applicable regulations and promoting common criteria and good practices in terms of privacy in the Group.

Telefónica promotes global coordination on privacy through different specialised forums, which allow aligning strategies, sharing good practices and ensuring the effective application of privacy policies throughout the organization. There are two separate forums, the Privacy Committee and the Local DPO Forum. These forums meet every six months, consolidating a solid and transversal governance in terms of privacy.

In addition, the Board of Directors participates in this governance structure: each year, the DPO submits a detailed report to the Board through the Audit and Control Committee, while the Sustainability and Regulation Committee oversees the implementation of the Global Responsible Business Plan and compliance with privacy objectives.

Solid policies to manage protection of privacy at Telefónica 

Telefónica’s Global Privacy Policy, approved by the Board of Directors, constitutes the regulatory basis on which the data processing processes in all the Group’s units are articulated. This is complemented by: 

• The Regulation of the Governance Model for the Protection of Personal Data, which defines the organizational and strategic framework for applying privacy policies. 
• The Regulations on Requests by Competent Authorities, which establishes the principles of collaboration with regulatory bodies. 

In addition, we have Operational Domains that make up internal procedures to reinforce data protection throughout the Telefónica footprint. These domains include guidelines on records of processing activities, data classification, third-party management, internal audits, security breach response, and data retention and deletion, among other relevant matters. The most recent update of these Operational Domains took place in November 2023 and extended their scope to all data protection jurisdictions within the Telefónica Group, reinforcing the harmonization of data protection practices in all regions.

Another key pillar of Telefónica’s data privacy policies is the Binding Corporate Rules (BCR), approved by the Spanish Data Protection Agency. The BCRs ensure the protection and legitimacy of international transfers of personal data outside the EU between the different companies in the Telefónica Group.

Risk management and privacy by design: technical pillars of privacy at Telefónica 

Privacy risk management is high on Telefónica’s corporate strategy. Through a dedicated internal platform, all data processing activities are evaluated and documented, applying the necessary measures and controls to mitigate the identified risks.

The company applies a model based on the Principle of Proactive Responsibility, according to which it conducts continuous and rigorous self-assessments of regulatory compliance, aiming to ensure the effective integration of privacy throughout all phases of the data life cycle.

This approach is reinforced by the application of the principle of Privacy by Design, which involves considering, from the earliest stages of development, all processes that may affect personal data. Telefónica has developed its own Privacy by Design guidelines and provides a set of rules, standards, as well as legal and security processes. 

In addition, Open Gateway, an initiative led by the GSMA, transforms networks into open platforms through global APIs designed with privacy by design. Telefónica actively manages privacy in this environment, ensuring the control of personal data in front of authorities and users. 

Transparency and empowerment: the user-centred approach 

Transparency in the processing of personal data is one of Telefónica’s strategic axes. Through the Global Transparency Center, the company facilitates public access to its privacy and security policies, offering clear information through visual tools, guides on digital rights, and ethical principles applied to artificial intelligence. 

At the operational level, there are Local Transparency Centres in the countries where it operates, which provide accessible information on the management of personal data, privacy conditions, online child protection and the exercise of rights. In addition, a Telecommunications Transparency Report is published annually, detailing requests for access to data by authorities and how they are managed in a way that respects fundamental rights.

Consultation mechanisms and supply chain: culture of compliance in privacy at Telefónica 

To consolidate a culture of compliance, Telefónica has designed multiple channels and training and consultation actions. Among them are: 

• Data protection mailboxes accessible by letter, email or call, as indicated in the legal notices and privacy policies. 
• Direct attention through the Data Protection Officers (DPOs) of each operation of the Group. 
• Electronic channels, such as the Mi Movistar app and the personal area in www.movistar.es. 
• Customer Defence Service, which acts as a second instance for complaints not resolved through the usual channels. 
• Adherence to sectoral codes of conduct, such as that of Telecommunications Operators in Spain and that of AUTOCONTROL for advertising activities. 
• Consultation channel available on the corporate website, aimed at topics related to the Principles of Responsible Business. 

During 2025, 11 complaints and/or mediations have been processed within the framework of the Code of Conduct for Telecommunications Operators in Spain. In addition, within the framework of the AUTOCONTROL Code of Conduct for the “Data Processing in Advertising Activities”, approved by the AEPD, 64 complaints or mediations have been processed in 2025.

At the same time, Telefónica has strengthened control over its supply chain in terms of privacy. The incorporation of common data protection agreements for the entire Telefónica Group and issues related to the commitments assumed by the provider in terms of international transfers have been reinforced.  In addition, procedures have been implemented for monitoring suppliers and disseminating educational materials using tools created by Telefónica.

Specifically, automated control measures have been implemented to ensure the proper processing of personal data before, during and after the provision of the service by the provider.

Digital transformation and data privacy at Telefónica: innovation with a human approach 

Privacy and cybersecurity are two axes that Telefónica has integrated transversally in its digital transformation. Through its internal compliance platform, it centralizes, among other actions: 

• Treatment Records 
• Incident Management 
• Privacy KPI Report 
• Rights Records

This platform also includes tracking data breach incidents and managing Telefónica’s internal perimeter.

This tool not only streamlines processes, but also offers an integrated, real-time view of compliance status, allowing tasks to be automated, risk reduction, and improved data protection decision-making.

Training in personal data protection and cybersecurity

Telefónica recognises the importance of training and awareness in data protection and privacy, both for its employees and for relevant third parties. For this reason, it offers mandatory privacy-specific courses that cover its entire corporate footprint, complemented by training material aimed at key suppliers from a privacy perspective.

An updated version of the privacy awareness course was distributed in 2024, with the aim of training employees on privacy concepts and their practical application in daily functions. This update seeks to offer more practical training adapted to the internal procedures implemented to comply with the requirements of the Regulation.

Throughout 2025, Telefónica provided 51,748.13 hours of training on data protection and cybersecurity, reaching more than 68,000 attendees. In addition, it annually updates and expands the scope of its training to ensure alignment with company privacy policies and regulatory requirements.

Privacy at Telefónica as an integral commitment and driver of digital trust 

Data privacy at Telefónica is not an add-on, but an essential condition integrated into its corporate DNA. From the design of its products to the relationship with customers, suppliers and regulators, Telefónica articulates a strategy that combines legality, technological innovation, user empowerment and ethical commitment. 

In an environment where privacy in technology companies is more than a legal requirement, Telefónica demonstrates that it is possible to lead the digital future with transparency, responsibility and respect for people’s rights. 

To learn more about Telefónica’s initiatives and results in terms of privacy and data protection, we invite you to consult the full report available at the following link: