GDPR Banking: Data Protection for Financial Services

Banks are subject to sector-specific regulations beyond the GDPR, including banking acts, anti-money laundering laws, risk management standards and IT security requirements. The GDPR additionally requires records of processing activities, data protection impact assessments for high-risk processing, consent management and processes for data subject rights. Banks must align these requirements with existing obligations from anti-money laundering legislation and banking supervision.

Banking secrecy obliges credit institutions not to disclose customer data to third parties without authorisation. The GDPR supplements this protection with additional rights: customers can request information about stored data, demand corrections or request deletion. Both regimes aim to protect personal data but differ in legal basis and scope. Banks must consider both systems in an integrated way to avoid contradictions.

A data protection impact assessment (DPIA) under Art. 35 GDPR is required when data processing is likely to result in a high risk to the rights and freedoms of data subjects. In banking, this typically applies to credit scoring, automated decision-making systems, video surveillance in branches and new digital banking products. The DPIA documents risks and defines countermeasures before processing begins.

GDPR violations can result in fines of up to 20 million euros or four per cent of global annual turnover — whichever is higher. For banks, additional supervisory consequences may apply, such as conditions, special audits or in extreme cases the withdrawal of the banking licence. In practice, fines in the millions have already been imposed on financial institutions multiple times.

The GDPR grants data subjects rights to access, rectification, erasure, restriction of processing, data portability and objection. Banks must establish clear processes that respond to requests within one month. A particular challenge arises from retention obligations under anti-money laundering and tax legislation, which may prevent immediate deletion. A differentiated deletion strategy is necessary.

Banks are generally required to appoint a data protection officer (DPO) under both the GDPR (Art. 37) and national data protection law. The DPO monitors compliance with data protection regulations, advises on data protection impact assessments, trains staff and serves as a contact point for data subjects and supervisory authorities. The DPO must act independently and possess expertise in both data protection and banking law.

Many banks transfer customer data to third countries — through cloud services, intra-group data sharing or payment processing. The GDPR permits such transfers only under specific conditions: adequacy decisions by the European Commission, standard contractual clauses (SCCs) or binding corporate rules (BCRs). Since the Schrems II ruling, banks must additionally conduct a transfer impact assessment.