Personal data protection in financial services

Today, data protection in banks and insurance companies is essential. Digitalisation has made institutions more vulnerable. They collaborate with start-ups and Big Tech, exposing more sensitive information.

Industry reports show real risks. The use of personal apps and generative artificial intelligence is dangerous. Social engineering attacks put personal data at risk. Strong cybersecurity measures and clear procedures are essential to protect customers’ data.

The regulatory framework, led by the GDPR, requires privacy by design and by default. Detailed documentation and limits on processing are necessary. Banks must strike a balance between innovation and compliance. They must be transparent in their privacy notices and provide tools for data subjects to exercise their rights.

Data protection: key principles in the financial sector

Data protection is essential for banks and insurance companies. These entities handle enormous amounts of sensitive information. They must follow clear rules for personal data management.

It is important to strike a balance between operational needs and transparency with customers.

Definition and relevance of data protection for banks and insurance companies

The GDPR defines personal data as any information relating to an identifiable person. Banks are responsible for processing and must inform customers clearly.

Personal data management must be transparent and respect data subjects’ rights. For example, Banca d’Italia shows how data is used for supervision, while respecting retention limits and security requirements.

GDPR principles applied to the financial sector

The GDPR requires data to be processed lawfully, only as necessary, kept to a minimum, retained for a limited period and protected in terms of integrity and confidentiality. Banks must specify the legal basis for processing, such as consent or the performance of contracts.

To be compliant, financial institutions must have clear policies, records of processing activities and impact assessments. Using technical tools such as DLP and application monitoring helps prevent the unauthorised uploading of sensitive data.

Privacy by design and privacy by default in the design of financial services

Article 25 of the GDPR requires banks to apply privacy by design and privacy by default from the design stage. Systems must have appropriate technical and organisational measures, and choices must be documented.

Privacy by design requires assessing risks and finding solutions that reduce the data processed. Privacy by default requires default settings to protect users by limiting unnecessary sharing.

A good operational approach includes blocking unauthorised uploads/downloads, controlling personal apps on company devices and establishing rules for the use of generative artificial intelligence. These measures strengthen data protection and improve personal data management.

Main threats to privacy protection in financial services

Banks face growing risks. They use personal apps, artificial intelligence and social engineering. This creates privacy problems.

Banks, start-ups and large companies work together. This increases the risk to data. It is important to manage data and obtain consent.

Risks associated with employees’ use of personal applications

92% of employees use personal apps. 13% upload sensitive data to non-company services. This can lead to the loss of regulated data.

74% of policy breaches involve personal or financial data. Without security measures, privacy is at risk.

Impact and risks of generative artificial intelligence (genAI) applications

95% of organisations use genAI. They use an average of 10 apps per organisation. This can cause privacy problems.

It is important to check the data being transferred. The data fed into models must also be limited. Without a record, it is difficult to comply with the GDPR.

Social engineering threats, credential theft and MFA compromise

Social engineering campaigns use phishing and malware. Around 9.8 out of every 1,000 users download malware each month. This includes JavaScript downloaders and beacons such as Cobalt Strike.

Credential theft is a major problem. Attackers exploit authentication errors and gaps in MFA. This puts customers’ and employees’ privacy at risk.

To address these risks, endpoints must be controlled and access segmented. It is also important to monitor behavioural anomalies and train employees on social engineering.

Threat	Observed incidence	Main effect	Recommended countermeasures
Unmanaged personal apps	92% usage, 13% uploading sensitive data	Loss of control over regulated data	DLP, BYOD policies, application isolation
Ungoverned genAI	95% of organisations, average of 10 apps	Exfiltration and unintended retention	DPIA assessments, data whitelists, supplier contracts
Social engineering	9.8 per 1,000 users monthly	Malware installation, credential theft	Training, simulated phishing, robust MFA
Malware and beacons	Growth in families such as JS downloaders and Cobalt Strike	Command and control, continuous exfiltration	Threat intelligence, EDR, network segmentation
Transfers to third parties (Big Tech, start-ups)	Increased platform integration	Data exposure and risks of unlawful transfers	Data minimisation, lawfulness checks, DPI clauses

Regulatory compliance: GDPR, PSD2, DORA and obligations for intermediaries

Banks and financial intermediaries must follow complex rules. These rules help ensure that personal data is handled properly. The regulatory framework requires transparency, ICT security and accountability throughout the supply chain.

The GDPR applies to institutions based in the EU and those processing EU data. It requires clear information to be provided and data subjects’ rights to be respected. It is also important to establish the legal basis for each processing activity.

PSD2 requires access to be opened up to Third Party Providers. Banks must protect their APIs and access channels. This is to prevent data theft and unauthorised access.

DORA focuses on ICT risk and digital resilience. It requires ongoing checks and incident reporting. Tests such as the Threat-Led Penetration Test are essential for reducing risks.

Third-party risk management is essential. Attackers look for weaknesses in the supply chain. Intermediaries must map their suppliers and assess their controls.

Information requirements are crucial. Data subjects must know who processes their data and for what purpose. In some cases, certain rights may be restricted.

It is important to document the legal basis for each processing activity. Informed consent is central to certain processing activities. It must be freely given, specific and well documented.

To remain compliant, institutions must coordinate governance and privacy by design. Reporting, regular audits and information sharing improve collective resilience.

The table summarises the responsibilities and measures required of intermediaries under the GDPR, PSD2 and DORA.

Regulatory area	Main obligations	Practical measures
GDPR	Transparency, data subjects’ rights, legal basis for processing	Privacy notices, records of processing activities, DPIA, documented informed consent
PSD2	Secure access for TPP, strong customer authentication	API protection, tokenisation, access logs and authorisation checks
DORA	ICT risk management, business continuity, supply chain oversight	Incident reporting, TLPT, supplier assessment and resilience plans
Regulatory overlap	Integrated data protection and digital resilience	Combined governance, shared policies, audits and information sharing

Technical and organisational measures for cybersecurity and personal data management

Banks and insurance companies must protect customer data through technical and organisational measures. They use clear policies, targeted training and advanced technologies. This reduces operational risk and respects privacy.

HTTP/HTTPS traffic inspection, DLP and blocking risky downloads

It is crucial to monitor all HTTP/HTTPS traffic, both cloud and web. This helps stop phishing, malware and harmful content before they reach users. This ensures consistent rules are applied to all external connections.

For high-risk files, static and dynamic analysis is recommended before downloading. Patient Zero policies can block the transfer until the inspection results are available. DLP helps identify sensitive data, passwords and intellectual property on unauthorised apps or genAI instances.

Intrusion prevention systems, behavioural analysis and threat intelligence

Intrusion prevention systems (IPS) identify and block traffic patterns associated with command and control. This limits attackers’ activities and protects the network against more sophisticated campaigns.

Behavioural analysis detects compromised devices or accounts by identifying beacons and lateral movement. Integrating threat intelligence improves time to detection and provides useful operational context for updating rules and indicators of compromise.

Remote Browser Isolation, real-time coaching and reducing the application perimeter

Remote Browser Isolation protects browsing on risky domains by isolating content execution in a remote environment. This technique reduces endpoints’ direct exposure and limits the possibility of browser-based infections.

Real-time coaching reminds users of policies on personal apps and genAI, collects feedback and helps refine the rules. Reducing the application perimeter by allowing only certified instances reduces the attack surface and simplifies compliance checks.

• Document the measures adopted and assess the state of the art using a risk-based approach.
• Implement encryption, access controls and retention policies to minimise the use of sensitive data.
• Integrate threat intelligence and DLP with traffic inspection and IPS for a multi-layered defence.

These actions, implemented with appropriate procedures and records, enable banks and insurance companies to manage risk. They demonstrate accountability in the protection of personal data.

Personal data management in the bank–customer relationship

The relationship between a bank and its customer must be clear about the right to privacy. Before the relationship begins, the bank provides a privacy notice. This explains how and why personal data is processed.

Customers have the right to access, correct or delete their data. The bank must make these requests easy to submit. In some cases, however, the bank may restrict these rights for security reasons.

The processing of sensitive data follows strict rules. Sensitive data, such as health information or political opinions, requires explicit consent. The bank must have a sound legal basis for processing this data.

Banks disclose personal data to third parties transparently. The Banca d’Italia’s Centrale Rischi receives this information to monitor and manage credit. The bank informs the customer about these disclosures.

Data is retained for as long as necessary. For the Centrale Rischi, retention periods are set for risk monitoring and management. Customers can request access to or rectification of their data. Some disclosures may temporarily limit customers’ rights.

Area	Bank’s obligations	Customer’s rights
Privacy notice and transparency	Provide a privacy notice before processing, stating the legal basis and timeframes	Exercising the right to privacy, access to information
Individual rights	Procedure for access, rectification, erasure and restriction	Request correction or erasure of data
Special categories of data	Obtain explicit consent or another legal basis for processing sensitive data	Withdrawal of consent where applicable and information about processing
Transfers to third parties	Disclose transfers to the Centrale Rischi, authorities and intermediaries with a legal basis	Access to transferred data and requests for rectification
Retention	Retain data for the necessary period, document retention criteria	Information about retention periods and the possibility of erasure if data is no longer needed

Risk governance strategies and responsibilities of data controllers and processors

Risk governance requires clarity between controllers and processors. Banks must define who does what and how to move from one level to another. This helps demonstrate compliance with regulations and improve incident management.

Before processing begins, an impact assessment must be carried out. This study considers the type of processing and its purpose. Possible measures are assessed and decisions are documented to demonstrate that obligations have been fulfilled.

Data protection impact assessment and a risk-based approach

Impact assessments help identify and manage risks. They must include an analysis of technical solutions and explain why they are appropriate. This helps prepare for audits and respond to supervisory authorities.

Third-party risk management and supply chain oversight

Third-party management is essential because attackers often target the supply chain. Regulations require contracts to be checked, regular audits to be carried out and incidents to be reported. Technical measures must be used and penetration testing must be carried out on suppliers.

Training, security culture and organisational measures to reduce human risk

Security is built through practical, measurable actions. Training and real-time coaching are important. Phishing simulations must be carried out, and clear rules must be in place for the use of applications.

Behavioural indicators and continuous monitoring help determine whether actions are effective. This reduces human error and improves resilience while maintaining regulatory compliance.

Conclusion

The financial sector must strike a balance between innovation and data protection. It is important to adopt security measures such as traffic inspection and DLP. These actions reduce vulnerabilities and improve cybersecurity.

Banks and insurers must integrate privacy into their operations. Using a risk-based approach helps them comply with regulations such as GDPR and DORA. This improves customer relationships and respects customers’ right to privacy.

Data management is crucial to the stability of the financial sector. Clear procedures for data retention and disclosure are essential. The combination of technical measures, risk governance and a security culture protects data and privacy.