UK GDPR for Financial Services Firms: A Practical Compliance Guide

The two laws, and the two regulators

Data protection in the UK rests on two instruments that work together. The UK GDPR sets out the core rules for processing personal data. The Data Protection Act 2018 supplements it, filling in the detail that the GDPR leaves to national law, setting out exemptions, and establishing the powers and functions of the Information Commissioner. The ICO's guidance is explicit that the UK GDPR is read alongside the Data Protection Act 2018.

For a financial firm this means you are answerable to two regulators on the same book of business. The FCA cares that you keep orderly records, treat customers fairly and manage financial crime risk. The ICO cares that the personal data inside those records is collected lawfully, kept securely and used only for legitimate purposes. Neither regulator disapplies the other. A firm can be fully compliant with FCA rules and still breach the UK GDPR, and vice versa.

The practical consequence is that data protection cannot be delegated to a single privacy notice on the website and then forgotten. It has to be built into onboarding, marketing, complaint handling, outsourcing arrangements and record retention. The sections that follow set out the building blocks, starting with the principles that sit at the heart of the whole regime.

The six data protection principles

Article 5 of the UK GDPR sets out the principles that underpin everything else. There are six principles governing how you handle personal data, plus a separate overarching accountability principle. The ICO describes them as the principles that lie at the heart of the general data protection regime, informing everything that follows. Infringing the basic principles is subject to the highest tier of fines, so this is not abstract theory.

For a financial firm, three of these principles do the most day-to-day work. Purpose limitation stops you quietly reusing customer data collected for onboarding to feed a marketing campaign. Data minimisation challenges the habit of collecting everything just in case. Storage limitation forces a conversation with your FCA-driven retention schedule, because you may not keep personal data in identifiable form for longer than you need it, even where a separate rule permits or requires retention for a defined period.

The table below sets out the six principles in the ICO's own terms. The seventh element, accountability, is not a processing rule but an obligation to be able to demonstrate compliance with the other six. It is covered separately below.

Choosing a lawful basis

You cannot process personal data at all unless you have a lawful basis for doing so. The ICO is clear that you must identify at least one of the bases in Article 6 whenever you handle personal information. There are six to choose from, and the choice matters, because it shapes which rights the individual can exercise and how much freedom you have.

Three of the six are the workhorses for financial services. Contract covers the processing needed to deliver the product or service the customer has asked for, such as administering an account or executing a trade. Legal obligation covers processing you must carry out to comply with the law, which for a regulated firm is a broad category taking in anti-money-laundering customer due diligence and various FCA-mandated activities. Legitimate interests is the most flexible basis, available where processing is necessary for your interests or a third party's, unless those are overridden by a good reason to protect the individual; it typically supports activities such as fraud prevention and certain internal analytics.

It is worth being precise about what necessary means, because it is often misread. The ICO's guidance says necessary does not mean the processing has to be absolutely essential, but it must be more than merely useful and more than standard practice. It has to be a targeted and proportionate way of achieving a specific purpose. If you could reasonably achieve the same aim in a less intrusive way, the processing is not necessary and the basis does not hold. Consent, by contrast, is often the wrong basis for a regulated firm, because it must be freely given and can be withdrawn, which sits awkwardly with processing you are legally required to perform.

Special category data needs extra care

Some personal data is singled out for extra protection. The UK GDPR treats certain types as likely to be more sensitive, and the ICO lists them as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, together with genetic data, biometric data used for identification, and data concerning health, a person's sex life or their sexual orientation.

Financial firms encounter special category data more often than they expect. A protection or annuity application can turn on health information. Biometric checks used in digital onboarding produce biometric data. Even inferred data can qualify if it reveals something about one of the protected categories. Whenever you process it, the ICO's guidance is that you must identify both a lawful basis under Article 6 and a separate additional condition for processing the special category data. One is not enough on its own.

The same layered approach applies to criminal offence data. Where you process information about criminal convictions or offences, you need a lawful basis and, unless you have official authority to process it, an additional condition. For firms running sanctions and adverse-media screening, this is a live issue, and the lawful grounds for that processing should be documented rather than assumed.

The eight individual rights

The UK GDPR gives individuals a set of rights over their personal data, and financial firms must have operational procedures to honour them, not merely a policy that says they will. The ICO sets out eight rights: the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object, and rights related to automated decision-making and profiling.

The right of access, exercised through a subject access request, is the one most firms handle regularly. The ICO's guidance is that you must respond without undue delay and within one month of receiving the request. You can extend that by up to a further two months where the request is complex or you have received several from the same person, but you must tell the individual about the extension, and explain why, within the original month. There is no fee for a standard request.

The right to erasure, often called the right to be forgotten, is where the FCA overlap becomes sharpest. It is not an absolute right. The ICO confirms that a firm can refuse to erase data where it is legally obliged to keep it, for example to comply with financial or other regulations. So a customer cannot use an erasure request to force deletion of records you are required to retain under FCA rules or the Money Laundering Regulations. What you must do is apply the exemption deliberately, record why it applies, and erase anything that genuinely falls outside it, rather than treating any request as an all-or-nothing decision.

The 72-hour personal data breach rule

A personal data breach is more than a lost laptop or a hack. The ICO defines it as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. That includes accidental causes such as an email sent to the wrong recipient, not only deliberate attacks. For a financial firm, the volume of sensitive data moving through email, portals and third-party systems makes some level of breach exposure inevitable, which is why the response process matters so much.

The headline obligation is time-bound. The UK GDPR requires organisations to report certain personal data breaches to the ICO within 72 hours of becoming aware of the breach, where feasible. The clock starts when you become aware, not when your investigation finishes. Notification is required where the breach is likely to result in a risk to individuals' rights and freedoms; if you can demonstrate it is unlikely to result in a risk, you need not notify the ICO, but you must still record it internally. Where the breach is likely to result in a high risk to individuals, you must also inform the affected individuals without undue delay.

The ICO recognises that you may not have every detail within 72 hours. Article 33(4) allows you to provide information in phases, provided there is no undue further delay, so the priority is to notify on time and follow up as the picture becomes clearer rather than to stay silent while you investigate. When you do report, the ICO expects you to describe the nature of the breach, including where possible the categories and approximate number of individuals and records concerned, the name and contact details of your data protection officer or other contact point, the likely consequences, and the measures taken or proposed. The steps below give a practical sequence for the first hours after discovery.

The data protection fee and accountability

Almost every financial firm must pay an annual data protection fee to the ICO. Under the Data Protection (Charges and Information) Regulations 2018, organisations that use personal information must pay the fee unless they are exempt. There are three tiers, and firms are expected to pay between 52 pounds and 3,763 pounds depending on size. Tier 1, for micro organisations with a maximum turnover of 632,000 pounds or no more than 10 staff, is 52 pounds. Tier 2, for organisations up to 36 million pounds turnover or no more than 250 staff, is 78 pounds. Tier 3, for larger organisations, is 3,763 pounds. Failing to pay is itself a breach the ICO can act on.

Beyond the fee, the accountability principle in Article 5(2) requires you to be responsible for, and able to demonstrate, compliance with the other principles. In practice this means keeping records of your processing, documenting your lawful bases, maintaining policies and, for higher-risk processing, carrying out a data protection impact assessment. A DPIA is required before you begin processing that is likely to result in a high risk to individuals, and much of what financial firms do, such as large-scale profiling or new uses of biometric data, can fall into that category.

Accountability is also where data protection meets financial-services governance most naturally. The same senior-management ownership, documented policies and periodic review that the FCA expects for its regime can carry your data protection obligations too, provided the privacy dimension is genuinely built in rather than bolted on. Bringing privacy controls into the same framework you already use for FCA compliance is exactly the kind of consolidation our control tooling is designed to support, so that one set of evidence answers to both regulators. If you would like to see how that works against your own processing, you can book a walkthrough.

Conclusion

UK GDPR compliance for a financial firm is not a separate project bolted onto FCA work; it is the same customer data viewed through a second lens. The six principles set the standard, a lawful basis under Article 6 licenses each activity, special category data demands an extra condition, and eight individual rights give customers a say in how their information is used. Layered on top are hard obligations that leave little room for interpretation: the 72-hour breach notification, the annual data protection fee, and the accountability duty to demonstrate, not merely assert, that you comply.

The firms that manage this well treat the FCA and the ICO as two audiences for one control framework. They document lawful bases alongside retention rules, they apply the erasure exemption deliberately where regulatory retention requires it, and they can produce a breach timeline and a DPIA on demand. Get that integration right and data protection stops being a compliance tax and becomes part of the evidence base that shows, to either regulator, that you handle customers and their information properly.

Frequently asked questions