Data protection
GDPRAlso called general Data Protection Regulation, UK GDPR
Data protection is the legal framework governing how organisations collect, use, store and share personal data. In the EU it is set by the General Data Protection Regulation (GDPR). The UK applies its own version, the UK GDPR. Both require a lawful basis, limited use, security and respect for individuals' rights.
How it works
A regulated firm processes personal data on customers, staff and counterparties every day. It must record each processing activity, choose a lawful basis such as a legal obligation or legitimate interests, and keep data no longer than needed. Most banks and insurers must appoint a data protection officer. High-risk projects need a data protection impact assessment before launch.
Data protection matters because fines can reach €20 million or 4% of global annual turnover, whichever is higher. It also shapes compliance work elsewhere. KYC files, transaction monitoring, call recording and AI models all use personal data. Firms must balance retention duties under financial rules against the GDPR principle of keeping data only as long as necessary.
The rules
Personal data must be processed lawfully, fairly and securely, with breach notification, data subject rights and fines up to 4% of global turnover.
Any organisation processing personal data in the EU, or targeting people in the EURetains the GDPR framework in UK law after Brexit, supervised by the Information Commissioner's Office.
Organisations processing personal data in the UKAmends the UK GDPR, including a recognised legitimate interests basis, changes to automated decision-making, subject access and international transfer rules.
Organisations processing personal data in the UKCommon questions
Does the GDPR still apply in the UK?
The EU GDPR no longer applies directly in the UK. The UK kept the same framework as the UK GDPR, alongside the Data Protection Act 2018, and amended it through the Data (Use and Access) Act 2025. UK firms serving EU customers can also fall under the EU GDPR.
What are the maximum GDPR fines?
The highest tier of fines is €20 million or 4% of total worldwide annual turnover, whichever is higher. A lower tier of €10 million or 2% applies to breaches such as record-keeping and security failures. The UK equivalents are £17.5 million and £8.7 million.
How do GDPR and AML record keeping fit together?
AML rules require firms to keep customer due diligence and transaction records for set periods, usually five years. That legal obligation is a lawful basis for keeping the data. Once the period ends, the data should be deleted unless another legal basis applies.
Who enforces data protection rules?
In the EU, each member state has a data protection authority, with a lead authority for cross-border cases. In the UK, the Information Commissioner's Office enforces the UK GDPR. Financial regulators also take action where data failures breach their own systems and controls rules.
Our coverage
News and analysis on GRC and resilience from RegTech Post.
Read the coverage →RegTech PostGDPR Tech Stack: Tools Powering Privacy in the Corporate WorldRead the article →RegTech PostTikTok’s €530 Million GDPR Fine Raises Stakes for Cross-Border Data TransfersRead the article →
