Customer Service Has Changed: Is Your Company Prepared for the Contractual and Data Protection Implications?
As we have reported in recent days, Decree No. 13,135, dated October 9, 2026, published in the Federal Official Gazette on October 13, established new rules for the Customer Service Department (SAC), replacing Decree No. 11,034/2022.
The new regulations aim to make customer service more accessible, efficient, and effective, especially in light of the growing use of digital platforms, automated systems, and artificial intelligence tools.
The new regulations apply to providers of products and services regulated by the federal executive branch, subject to the criteria established by the respective regulatory agencies, and to providers of financial, payment, and credit services offered through digital means, which are subject to regulation or supervision by the Central Bank. The Decree also establishes specific obligations to provide information to the National Consumer Secretariat (Senacon) for certain digital intermediation, transportation, and delivery platforms.
Its effects extend beyond the operation of customer service channels to include the protection of personal data and contracts with suppliers, distributors, and service providers.
Among the main changes, the following stand out:
- The parties covered by this regulation must provide telephone support and real-time live assistance through electronic channels from 8:00 a.m. to 8:00 p.m., every day of the week, and at least one electronic channel must operate 24 hours a day, seven days a week, subject to sector-specific exceptions and regulations;
- For telephone support, a customer must be connected to an agent within 20 seconds for at least 80% of inquiries, and within five minutes for the remainder, subject to specific rules set by regulators;
- telephone and electronic channels may not require more than five levels to resolve a request, and it is prohibited to direct the consumer to another channel, except when in-person service is essential;
- The consumer must be able to request cancellation at any level of the customer service system. The request must also be received and processed through the same means and methods made available for signing up for the service, without being redirected to another menu, agent, or channel;
- In the event of an accidental interruption in live telephone service, the provider must resume the call within five minutes. Requests regarding unsolicited services or improper charges must be addressed immediately, with the suspension resolved within 48 hours.
The Decree maintains the general seven-calendar-day deadline for responding to non-urgent requests, but mandates immediate assistance, at any time, for urgent situations as defined by the applicable regulations.
Another important change is the prohibition of advertising messages during any stage of customer service. Unlike the previous regulations, which allowed advertising during the wait period subject to prior consent, the new rule does not provide for this exception.
The Decree expressly reaffirms the application of the General Data Protection Law (LGPD) to the processing of consumer information. Although this obligation already existed, the new requirements make it even more important to review procedures for the collection, use, sharing, and storage of personal data.
In practice, the Decree prevents suppliers from requiring consumers to provide certain information—such as their CPF, identification number, or address—in advance as a condition for receiving customer service or speaking with a live representative. This does not, however, prevent the company from requesting, during the service interaction, the data necessary to identify and authenticate the consumer, especially to access contractual information or perform transactions that require identity verification. In such cases, data collection must comply with the principles of purpose, adequacy, and necessity set forth in the LGPD.
The new record retention requirements also warrant attention: (i) records of customer inquiries must remain available for at least six months after their resolution, replacing the minimum two-year period provided for in the previous regulations; and (ii) telephone recordings and the contents of voice or text messages exchanged through customer service channels must be retained for at least 90 days.
The reduction in the minimum retention period for case histories does not constitute authorization for their indiscriminate disposal or an obligation to delete them immediately. Companies must align these periods with other legal and regulatory obligations, the need to preserve evidence, and the LGPD’s rules on retention and disposal.
The use of artificial intelligence in customer service channels—which is expressly permitted by the Decree—also requires caution. The use of data collected by customer service for additional purposes, such as model training, cannot be presumed to be automatically authorized by the original purpose of the service interaction.
From a contractual perspective, the new regulations recommend a review of both the agreements entered into with consumers and the contracts signed with companies responsible for operating customer service channels, particularly regarding cancellation and termination, data protection, and revisions to service level agreements (SLAs), among other matters.
It is also recommended that these agreements expressly govern access to customer service histories, the retention and deletion of records, the use of artificial intelligence tools, the role of subcontractors, and procedures for responding to security incidents and requests from data subjects.
The contractual allocation of responsibilities between the supplier and the service provider is important, but does not, in and of itself, preclude legal obligations toward consumers and competent authorities.
The new Customer Service Decree reinforces a regulatory trend: the quality of customer service depends not only on the availability of communication channels, but also on their effectiveness, transparency, accessibility, and security.
For the companies covered by the regulation, compliance will require coordinated action by the legal, commercial, technology, data protection, and customer service departments.
More than just updating operational procedures, it will be necessary to verify that contractual terms, data processing practices, and services provided by third parties are effectively aligned with the new requirements.
The Decree will take effect twenty days after its publication, so it is advisable to begin this assessment immediately.
–
This material is for informational purposes only and should not be relied upon solely for decision-making. Specific legal advice may be provided by one of our attorneys. Copyright is reserved by KESTENER VIEIRA TORRONTEGUY SPEGIORIN ADVOGADOS.
