Key points
- Protecting banking data involves data security, the European PSD2 directive (Directive (EU) 2015/2366) and strict application of the GDPR.
- Financial information is among the most exposed personal data, without falling within the sensitive data of Article 9 of the GDPR, and calls for technical and organisational measures against any breach.
- PSD2 requires robust protocols, in particular strong customer authentication, to make online payments safer and reduce fraud.
- Many banking organisations must appoint a DPO (Data Protection Officer), a pivotal figure who monitors the compliance of operations and recommends the necessary adjustments.
- Every employee with access to banking information should receive regular training in data security and confidentiality.
- The GDPR requires a legal basis for each processing operation (in banking, often the contract or a legal obligation) and limits processing to the data necessary for the stated purpose.
Protecting banking data plays a central role in the European regulatory landscape. Between the need to ensure the security of banking data, compliance with the obligations arising from the European PSD2 directive (Directive (EU) 2015/2366) and strict application of the GDPR, financial institutions face major challenges. The issues concern both data confidentiality and informing customers about each processing of their data. Let us examine how these legal requirements shape current practices and the responsibilities of the various parties involved.
What are the main obligations for protecting banking data under the GDPR?
Technological change in the banking sector has intensified the requirements for banking data security. The arrival of the General Data Protection Regulation (GDPR) considerably raised the bar by imposing stricter control over the collection and processing of data. Banking data is not among the sensitive data within the meaning of Article 9 of the GDPR, but its compromise exposes customers to a high risk, which justifies an enhanced level of protection.
Every institution is therefore required to adopt technical and organisational measures to prevent any breach in the storage and retention of data. The law also stresses the transparency of processing: clearly informing data subjects, ensuring the integrity and confidentiality of data, and strictly limiting access to authorised parties only.
Why does PSD2 affect the security of banking data?
The Payment Services Directive 2 (PSD2) requires robust protocols to make electronic transactions safer. Its key principle is strong customer authentication, required in French law by Article L. 133-44 of the French Monetary and Financial Code (Code monétaire et financier) (in French). This system aims to better protect access to bank accounts and reduce the risk of fraud by requiring at least two independent elements (knowledge, possession, inherence) when accessing an account online or making an electronic payment.
Reconciling PSD2 and the GDPR requires procedures that ensure speed, efficiency and process security at the same time, without sacrificing compliance with the principles of confidentiality and customer consent laid down by the General Data Protection Regulation.
What are the roles and responsibilities for banking data security?
The mandatory appointment of a data protection officer (DPO) in many banking organisations meets this need for legal and technical expertise. The DPO acts as a pivot, monitoring the compliance of operations and recommending the adjustments needed to correct any drift or gap identified in the management of sensitive data.
The CNIL (French data protection authority) cites banks, for their customer files, among the organisations that carry out regular and systematic monitoring on a large scale and must appoint a DPO. The cases where appointment is mandatory are detailed in our article When is a DPO mandatory?. The role can be entrusted to an outsourced DPO.
In parallel, every employee with access to banking information should receive regular training in security, data confidentiality and strict application of the internal policies adopted to meet legal obligations and the compliance expected by the authorities.
How can banking data be collected and processed in compliance with the GDPR?
The GDPR requires every collection and processing of banking data to be based on one of the legal bases in Article 6: in practice, performance of the contract or a legal obligation for operating the account, and customer consent for certain optional uses. PSD2 also requires the user’s explicit consent for payment service providers to access the data necessary for their services. Any new purpose must be analysed before it is implemented.
To check that each step of the processing complies with the fundamental principles, it is essential to learn how to bring data collection and processing into line with the GDPR (in French). Moreover, only data strictly necessary for the stated purpose may be processed. Any new purpose must be compatible with the original purpose or rest on its own legal basis, which strengthens the transparency of practices towards customers and gives them effective control over the use of their personal data.
- Systematically inform users about the nature, duration and objectives of the processing.
- Implement the right to data portability and to erasure.
- Limit collection to what is genuinely essential.
- Provide secure channels for customers to exercise their rights (access, rectification, erasure).
Why must the storage and retention of banking data be regulated?
The storage and retention of data are among the areas subject to strict scrutiny. The GDPR requires banks to set a maximum retention period linked to the purpose of the processing. At the end of this period, destruction or anonymisation must follow automatically, unless there is a legitimate reason for longer retention, for example in the event of litigation.
The servers used must offer strong safeguards against intrusion, theft or loss of data. All access and changes should also be documented precisely to build full traceability, which may be audited by the CNIL or any other competent body.
Which mechanisms strengthen the confidentiality of banking data?
Various measures help strengthen data confidentiality in the banking environment. Encryption is the first barrier against hacking attempts. On top of this come enhanced authentication procedures, often requiring one-time codes or biometric identifiers.
A well-designed protocol also provides for rigorous management of internal access rights, together with regular checks that the restrictions applied are effective. This also involves a centralised inventory of sensitive data and of the people authorised to handle it.
How does the interplay between the GDPR and PSD2 shape modern banking security?
The interplay between the GDPR and PSD2 is not simply a matter of placing two regulatory frameworks side by side: it creates new forms of shared responsibility. Third-party banking service providers, now authorised to access certain information, are themselves subject to heavy compliance obligations, failing which they face penalties.
Contracts between banks and external partners must clearly set out the terms of access to, use of and return of data. The allocation of tasks and controls is also among the essential points to address in any new collaboration, in order to protect customers’ interests and the overall security of financial information flows.
| Aspect compared | GDPR | PSD2 |
|---|---|---|
| Scope | All personal data | Payment-related data |
| Consent | One legal basis among six, not always consent | Explicit consent for providers’ access to data |
| Access security | General measures appropriate to the risk | Mandatory strong customer authentication |
| Penalties for non-compliance | Up to €20 million or 4% of worldwide turnover | Prohibition from operating and specific fines |
Frequently asked questions on banking data security and the GDPR
What are the main risks to the security of banking data?
The threats mainly include hacking, internal fraud and the accidental loss of media or files. A lack of encryption or poor access management can increase these risks. To limit these dangers, you should:
- Use robust encryption for all exchanges of sensitive data
- Train staff regularly in cybersecurity
- Deploy tools for automatic monitoring of suspicious connections
Who supervises banks’ compliance with the GDPR and PSD2?
The national data protection authority, such as the CNIL in France, monitors how banking institutions apply the GDPR in practice. For PSD2, the prudential authorities supervise compliance with technical and authentication standards. Having a data protection officer (DPO) ensures continuous oversight of the compliance of internal procedures, with the possibility of intervening in the event of an alert or complaint.
An ad hoc audit may also be required to check the reliability of the arrangements in place.
How can a customer exercise their rights over their banking data?
Every customer has a right of access, rectification and erasure over the banking data held by the institution. They may also object to certain processing or request the portability of their information. These requests can be made in several ways:
- Secure online form
- Dedicated data protection email address
- Written request addressed to the bank’s DPO
The bank must then respond within one month, save in duly justified special circumstances.
What documents must a bank keep to prove its GDPR compliance?
A bank needs to keep various records and evidence to demonstrate compliance with the GDPR. These include:
| Document | Purpose |
|---|---|
| Record of processing activities | Full traceability of collection and uses |
| Proof of consent | Demonstrating customers’ agreement for processing based on consent |
| Incident reports | Audit trail in the event of an actual incident |
| Contracts with processors | Assurance that the required security standards are met |
These records are systematically kept up to date and available for consultation at the request of the supervisory authority.
