In brief
- Regulation: GDPR.
- All banks are concerned as data controllers, at large scale.
- Ground every processing activity.
- Govern profiling.
- Governing automated decisions.
- Fines of up to €20M or 4% of global turnover, on top of the prudential and reputational stakes specific to the sector.
Regulatory deadlines
The key dates of this regulation.
May 2018
Entry into application
In forceWhat does GDPR cover?
GDPR requires a legal basis, data minimisation, limited retention periods, security and accountability. In banking, several processing activities rely on legal obligations (KYC, AML/CFT) while others are based on contract performance or legitimate interest.
Fully automated decisions producing significant effects — such as an automatic credit refusal — are strictly regulated: specific information requirements and the right to human intervention apply.
Is the 'Banking' sector in scope?
All banks are affected as data controllers, at large scale. The sensitivity of the purposes (credit, fraud, AML/CFT) raises the level of requirements, particularly regarding profiling and security.
Banking secrecy adds to GDPR without replacing it: both regimes coexist.
Detailed obligations
Ground every processing activity
Identify the appropriate legal basis: legal obligation (KYC, AML/CTF), performance of a contract (credit), legitimate interest (fraud) — documenting each choice.
Govern profiling
Informing individuals about profiling and its consequences, and guaranteeing the associated rights.
Governing automated decisions.
For fully automated decisions with significant effect, ensure specific information is provided and the right to human intervention is guaranteed.
Control retention periods
Apply retention periods suited to each purpose (credit, AML/CFT, fraud).
Secure at a high level
Implementing encryption, access control, traceability and monitoring, commensurate with the sensitivity of the data.
Manage breaches
Detect, qualify, and notify breaches within 72 hours, with notification to individuals if the risk is high.
Sanctions & risks
Fines of up to €20M or 4% of global turnover, in addition to the sector-specific prudential and reputational stakes. Profiling and automated decision-making are subject to particular scrutiny from the authorities.
A failure in scoring can also reveal non-compliance with the AI Act, with both texts applying cumulatively.
Common mistakes in the sector
- 1Unregulated automated decisions. Refusing credit in a fully automated manner without safeguards.
- 2Unclear legal bases. Failing to document the legal basis for each purpose.
- 3Excessive retention. Retaining data beyond justified retention periods.
- 4AI Act accumulation ignored. Addressing scoring solely from a GDPR perspective.
Practical case
A bank implements an automated credit refusal based on a score. The GDPR requires informing the applicant of the logic of the processing and offering them the right to human intervention. The bank adds a human review step upon request and documents the legal basis and retention period for scoring data.
Compliance roadmap
- 1
Map. Inventory KYC, credit, scoring, and fraud processing activities and their legal bases.
- 2
Governing profiling and decisions. Documenting information and safeguards on profiling and automated decision-making.
- 3
Define retention periods. Set retention periods by purpose.
- 4
Strengthen security. Align security and traceability with data sensitivity.
- 5
Equip the notification process. Implementing the breach notification procedure.
Frequently asked questions
GDPR regulates it strictly: specific information and the right to human intervention must be guaranteed for decisions with significant effects.
Take action on GDPR
Free assessment or a chat with an expert dedicated to bank.
They already trust us
See how organisations in the bank sector secured their compliance with DCO.