GDPR Data Protection Framework

GDPR for Financial Services

The General Data Protection Regulation (GDPR) establishes comprehensive data protection requirements applicable across the EU, with specific implications for financial services.

Key Principles

Article 5 - Data Protection Principles

1. Lawfulness, fairness, transparency
2. Purpose limitation
3. Data minimisation
4. Accuracy
5. Storage limitation
6. Integrity and confidentiality
7. Accountability

Lawful Bases

Six Legal Bases (Article 6)

1. Consent
2. Contract performance
3. Legal obligation
4. Vital interests
5. Public task
6. Legitimate interests

Financial Services Contexts

• Contract: Account management, transactions
• Legal obligation: AML/KYC, regulatory reporting
• Legitimate interests: Fraud prevention, marketing (with balance test)
• Consent: Additional services, profiling for marketing

Data Subject Rights

Key Rights

1. Right of access (Article 15)
2. Right to rectification (Article 16)
3. Right to erasure (Article 17)
4. Right to restriction (Article 18)
5. Right to data portability (Article 20)
6. Right to object (Article 21)
7. Rights related to automated decision-making (Article 22)

Financial Services Considerations

• Retention requirements may limit erasure
• AML data has specific rules
• Automated credit decisions require safeguards

Security Requirements

Article 32 - Security Measures

• Pseudonymisation and encryption
• Confidentiality, integrity, availability
• Resilience of processing systems
• Regular testing and evaluation

Breach Notification

• 72 hours to supervisory authority
• Without undue delay to data subjects (high risk)
• Documentation of all breaches

Special Categories

Article 9 - Sensitive Data

• Health data (insurance)
• Biometric data (authentication)
• Requires explicit consent or specific exemption

Data Protection Impact Assessment (DPIA)

When Required

• Systematic monitoring
• Large scale processing
• Automated decision-making with legal effects

Financial Services Triggers

• New payment services
• Fraud detection systems
• Credit scoring algorithms
• Customer profiling

Penalties

Administrative Fines

• Up to €20 million
• Or 4% of global annual turnover
• Whichever is higher

Cross-Border Transfers

Mechanisms

• Adequacy decisions
• Standard contractual clauses
• Binding corporate rules
• Derogations for specific situations