FIDA Consent Management Solution

A FIDA permission dashboard is an online interface that data holders (banks, insurers, financial institutions) must provide to every customer. Through the dashboard, customers can view all active access permissions they have granted to data users (e.g. fintechs or comparison portals). The dashboard must display the data user's name, the affected customer account, the purpose and duration of consent. Customers must be able to revoke granted permissions at any time. The FIDA regulation mandates this dashboard – non-compliance can lead to sanctions and exclusion from Financial Data Sharing Schemes.

FIDA requires granular consent options: customers must be able to choose whether to share basic information only (e.g. account balances) or detailed transaction histories. Consent must be purpose-bound – the customer must know what their data will be used for. The duration of the permission must also be clearly defined. The system must send notifications when permissions are about to expire or when new access requests are received. This granular control goes significantly beyond PSD2 requirements, which only provided for yes/no decisions on payment account data.

FIDA consent and GDPR consent are related but distinct legal bases. The GDPR governs general data protection and requires consent for processing personal data. FIDA specifically governs access to financial data and requires an additional customer permission for sharing data with third parties. A consent management system must address both requirements in an integrated way: GDPR consent for data processing and FIDA permission for data access. Documentation of both types of consent must be audit-proof.

The consent management system must provide real-time APIs through which data users can check consent status before retrieving data. The permission dashboard must be integrable as an online interface into existing customer portals or mobile banking apps. The architecture must support granular permissions at the level of individual data categories (accounts, transactions, insurance policies, investments). An audit trail must document all consents, changes and revocations traceably. The interfaces must comply with the technical standards agreed within the FDSS.

FIDA extends data access far beyond PSD2. Under the consent requirement: payment accounts and transaction data (already under PSD2), savings and fixed-term deposits, loans and mortgages, insurance contracts and claims data, pension products and retirement entitlements, securities and investment funds, and crypto-assets and digital assets. Separate consent options must be provided for each data category so that customers can decide precisely which data they share with which data user.

FIDA mandates that customers can revoke granted data sharing permissions at any time and without giving reasons. Revocation must be possible through the permission dashboard with a simple action. After revocation, data access for the affected data user must be blocked immediately. The system must inform the data user about the revocation and ensure no further data retrievals occur. The revocation must be documented in the audit trail. When implementing, note that revoking a FIDA permission operates independently of GDPR consent.

Integration typically occurs on three levels: first, the permission dashboard is embedded into the existing online banking or customer portal to ensure a seamless user experience. Second, a consent API layer is built that mediates between internal systems and external FDSS interfaces. Third, existing GDPR consent management is extended to handle FIDA-specific permissions and revocations. Existing PSD2 infrastructure (e.g. account information APIs) can serve as a foundation but must be expanded for the broader FIDA data categories.