Data protection in financial services means the legal duties, policies and technical controls that keep customer financial and personal data private, accurate and available. In the UK, it starts with UK GDPR and the Data Protection Act 2018, with FCA and PRA expectations on top. In practice, you need to know what data you hold, justify why you hold it, secure it and be able to prove all three to a regulator.
This guide covers why it matters, which rules apply, which controls to put in place and what a sound data protection policy for financial services should contain. It is written for compliance officers, IT managers and business owners at firms that handle customer money, credit or insurance.
TrustedIA has more than 30 years of experience in IT services and managed cyber security, including ISO 27001 implementation and certification support. The advice below reflects what firms actually need to do, not what looks good in a policy document.
Why data protection in financial services matters
It matters because financial data is unusually valuable to criminals and unusually closely regulated. A single breach can mean fraud against your customers, an ICO investigation, FCA scrutiny and a loss of trust that takes years to rebuild.
What financial firms hold
Banks, lenders, insurers, advisers and fintechs hold identity documents, account numbers, income and credit history. Mortgage and insurance products can add health information, which UK GDPR treats as special category data with stricter conditions for processing. Combined, these records let an attacker impersonate a customer convincingly.
Typical records include:
- Identity and KYC documents
- Transaction histories and credit scores
- Call recordings and customer correspondence
- Beneficiary, joint account and family details
- Health or vulnerability notes held for insurance or fair treatment
Family and beneficiary details are easy to overlook. Criminals use them for social engineering, such as pressuring a relative or passing identity checks, so they need the same protection as account data.
What a failure costs
Under UK GDPR, the ICO can fine up to £17.5 million or 4% of annual global turnover, whichever is higher. You must also report a notifiable breach to the ICO within 72 hours of becoming aware of it, and tell affected customers without undue delay when the risk to them is high.
Fines are rarely the largest bill. Remediation, customer compensation, forensic work, downtime and lost business usually cost more, and a breach invites FCA questions about your wider controls.
Regulators judge financial firms on whether they can demonstrate protection, not just whether a breach occurred.
The rules that apply to UK financial firms
UK financial firms answer to general data protection law and to financial regulation at the same time. You need to satisfy both, because meeting one does not excuse the other. The rules behind data protection in financial services are best read as layers.
Core data protection law
UK GDPR and the Data Protection Act 2018 set the baseline. They require a lawful basis for processing, data minimisation, appropriate security under Article 32, written contracts with processors and a data protection impact assessment for high-risk processing.
| Rule | What it covers | What it means for you |
|---|---|---|
| UK GDPR and Data Protection Act 2018 | Lawful processing, security, individual rights, breach reporting | Core duties for every firm holding personal data |
| Data (Use and Access) Act 2025 | Amends parts of UK GDPR and the 2018 Act | Check current ICO guidance when updating policies |
| PCI DSS | Payment card data handling | Industry standard, usually enforced through your acquirer |
If you serve customers in the EU, EU GDPR and, for in-scope entities, DORA may also apply. Take advice on that before assuming UK rules are enough.
Sector rules that sit on top
The FCA Handbook expects firms to run adequate systems and controls and to manage risk properly. FCA and PRA operational resilience rules add a requirement to keep important business services within set impact tolerances, so a ransomware outage is a regulatory problem as well as an IT one.
Customer rights also interact with financial law. People can ask for access to their data, usually answered within one month, and for correction. Erasure is limited, though. The Money Laundering Regulations 2017 require you to keep due diligence records for five years after the relationship ends, and that legal duty takes priority.
Where financial regulation requires you to keep data, erasure requests have limits, but your duty to secure that data never lapses.
How to protect customer data in practice
Protect customer data by working in a fixed order: know what you hold, restrict who can reach it, secure it technically, then plan for the day something fails. Skipping the first step is the most common reason data protection in financial services programmes stall.
Map your data and limit access
Build a data map that records what you hold, where it lives, who can access it and why. Include spreadsheets, email, backups and supplier systems, not just core platforms. Then apply least privilege and review access regularly.
- List every system holding customer data, including shadow IT.
- Record the lawful basis and retention period for each data set.
- Give staff only the access their role needs.
- Review leavers and role changes monthly.
Layer the technical controls
Start with encryption in transit and at rest and multi-factor authentication on every system that touches customer data. Add endpoint detection, patching, network segmentation and tested backups. Logging only helps if someone watches it, which is why many smaller firms use a managed Security Operations Centre rather than build one.
Test data deserves special attention. Copying live customer databases into development environments is common and risky. Mask or generate synthetic data instead.
Plan for incidents and suppliers
Write an incident response plan that names who decides, who calls the ICO and how you meet the 72-hour deadline. Rehearse it. Choose a partner such as TrustedIA’s managed security services before an incident, not during one.
Your suppliers are part of your risk. Under UK GDPR you stay responsible for personal data you pass to processors, so check their security, sign proper contracts and review them annually. Phishing simulation and staff training close the human gap that technology cannot.
You cannot outsource accountability, only the work, so choose suppliers as carefully as you configure systems.
What a data protection policy for financial services should cover
A good policy turns legal duties into rules staff can follow. It should be short enough to read, specific enough to audit and owned by a named person. A data protection policy for financial services differs from a generic one mainly in retention, third parties and regulatory reporting.
The sections to include
| Section | What to state |
|---|---|
| Scope and roles | Systems and people covered, DPO or responsible lead, board oversight |
| Lawful bases | Basis for each processing activity, including legal obligation for KYC and AML |
| Data minimisation and retention | What you collect, how long you keep it, who deletes it |
| Security standards | Encryption, MFA, access control, logging, patching |
| Individual rights | How requests are logged, verified and answered within one month |
| Third parties | Due diligence, contracts, international transfer safeguards |
| Incident and breach response | Escalation route, 72-hour ICO reporting, customer notification |
| Training and review | Induction, annual refreshers, policy review date |
Say plainly where financial regulation overrides a right. If a customer asks for erasure but anti-money laundering rules require you to keep their records, the policy should tell staff how to explain the refusal and when the data will be deleted.
Keeping the policy alive
A policy that nobody tests is a liability. Check it against reality with spot audits, a tabletop incident exercise and a review after any major system change. If you work towards ISO 27001, these checks become part of your management system, and the certification gives customers and partners independent assurance.
A policy only protects you if your staff follow it and you can show evidence that they do.
Where to start
Data protection in financial services comes down to four things: knowing your data, meeting both UK GDPR and FCA expectations, putting layered controls around customer records, and writing a policy your staff can follow and you can evidence.
Begin with the data map. It exposes the gaps in access, retention and suppliers that most firms find uncomfortable but fixable. Then test your incident plan against the 72-hour deadline before a real breach does it for you.
If you want an independent view of where your firm stands, talk to TrustedIA about your cyber security and data protection needs. We will assess your posture and recommend what fits, without pushing any particular vendor.
