The relevance of data discovery for financial services compliance

In the dynamic world of financial services, data is a critical necessity. Driven by many factors, much of this data is personal information and transaction data. Financial regulations mandate both that financial service companies collect and retain specific types of information and that they protect the security of the data and individuals’ privacy rights. The role of data discovery for financial services is becoming a necessity in achieving and maintaining compliance with these regulations.

Financial services are essential for the modern economy, and they handle vast amounts of sensitive information. This requires a careful balance between fulfilling their business objectives, complying with the law, protecting their customers’ interests and enabling data-driven innovation.

In this article, we’ll explore how data discovery can help financial services companies comply with regulatory and legal requirements and its value as a foundation for effective data management and cybersecurity.

Navigating the regulatory landscape

The financial services sector is among the most heavily regulated worldwide. These regulatory frameworks have been established to ensure the protection and privacy of data alongside other fiduciary responsibilities. While each country has its own financial services regulation, there are commonalities in the approaches mandated for data protection and cybersecurity.

In the EU, the General Data Protection Regulation (GDPR) is a security framework designed to protect the privacy rights and data security of EU citizens. The Digital Operational Resilience Act (DORA) is a new European framework that focuses on embedding a more robust and resilient approach to delivering digital capabilities for financial entities, aiming to further enhance cyber-resilience in the financial services industry. The EU has proposed a new Financial Data Access (FIDA) framework, which is a flagship initiative of the EU Digital Finance strategy and forms the legislative backbone for the EU-wide implementation of open finance. FIDA will grant consumers and SMEs the right to authorize third parties to access their data held by financial institutions.

In the UK, data protection and privacy are principally regulated by the federal Privacy Act 1988. The Financial Conduct Authority (FCA) also provides guidelines for data security in UK financial services.

In the US, several federal and state laws regulate data security in the financial sector. Among others, the Gramm-Leach-Bliley Act (GLBA) directs financial regulators to implement disclosure requirements and security measures to safeguard private information. The Sarbanes Oxley Act (SOX) and the Bank Secrecy Act (BSA) cover secure transactions, data storage, fraud and anti-money laundering obligations.

In Australia, data protection and privacy are regulated by the Privacy Act 1988. This Act regulates the collection, use, storage, and disclosure of personal information by private sector organizations and federal government agencies. For licensed Financial Service Organizations (FSOs) that are subject to oversight from the Australian Prudential Regulatory Authority (APRA), there are a number of mandatory standards and guidelines relating to information security and data management.

In addition to the regional legal and regulatory frameworks, financial service organizations, particularly payment service providers, are often required to comply with international security and audit standards. These include:

• Payment Card Industry Data Security Standard (PCI DSS) — PCI DSS is a contractual obligation for any organization that handles cardholder information, providing a baseline of technical and operational requirements designed to protect account data.
• ISO/IEC 27001:2022 for information security management systems — ISO 27001:2022 is a globally recognized standard mandating numerous controls for the establishment, maintenance, and certification of an information security management system.
• Service Organization Control 2 (SOC2) — SOC2 is an auditing procedure that ensures service providers securely manage data to protect the interests of the organization and the privacy of its clients. These standards play a significant role in strengthening cybersecurity measures, helping organizations mitigate risks, and ensuring the confidentiality, integrity, and availability of customer data.

Data security and compliance challenges in the financial sector

Financial institutions handle large volumes of sensitive and personal data, such as customer identities, financial transactions, credit histories, and more. This data is essential for providing financial services and products, but also exposes financial institutions to various risks and threats, such as data loss, theft, or breach.

One of the main concerns for financial service organizations is to prevent and mitigate data loss, theft or breach. Such incidents could be the result of human error, malicious insiders or cyber-attacks. While human error is generally unintentional, it often results in the unauthorized disclosure of sensitive data, either internally or externally.

Cyber-attacks exploit vulnerabilities in the systems, networks or devices of financial institutions, or use malware, ransomware or denial-of-service to compromise data or disrupt data availability and integrity. Phishing and social engineering techniques are often targeted at financial services employees with access to sensitive customer and financial information into revealing data or credentials, or clicking on malicious links or attachments which introduce malware into the network.

While it aims to protect financial services organizations from falling victim to data-related security incidents, the sheer amount of regulation governing the activities and obligations of the financial services sector is overwhelming. On top of industry regulation, financial institutions must comply with the burgeoning data protection and privacy laws worldwide, many of which have cross-border implications.

The impact and consequences of data loss, theft, or breach, or non-compliance with regulation, can be severe and long-lasting for financial service organizations. The reputational damage that can result from negative publicity following a data breach can lead to reduced market share and lost business.

The regulatory fines imposed by regional regulatory authorities and agencies can be significant. For example, in the US regulators imposed more than $5bn in penalties in 2023 – a 69% increase on the previous year.

Further, the costs of legal liabilities that can arise from lawsuits, claims and settlements from customers, partners and other stakeholders can continue long after the original incident occurred.

Data discovery as a solution for data security and compliance

Central to complying with their legal and regulatory obligations for data security, financial service organizations need to start with their data — establishing a clear understanding of their data landscape and identifying sensitive data assets across all systems and network environments.

Using a data discovery solution like Enterprise Recon Pro, financial service entities can find, analyze and manage their sensitive data — including personal information and other proprietary and secret information.

Data discovery can help financial service organizations improve their data security and regulatory compliance by enabling them to:

• Identify where protected data types reside across different systems, platforms and locations — including on-premises or third-party hosted networks and cloud-based environments. Data discovery combined with data risk-profiling can help financial institutions map and classify their data according to its type, source, owner, sensitivity and value. This can also help them identify any data duplication and redundancy.
• Verify that storage locations are authorized and secured with appropriate access controls. Data discovery helps identify the systems storing sensitive data assets, enabling organizations to validate that they are compliant with relevant data security and privacy requirements, such as encryption, identity and access controls, system logging, etc. In turn, these controls help prevent unauthorized access, modification or disclosure of data, and enable timely detection of any data breaches or anomalies.
• Manage data identified outside authorized areas by deleting, encrypting, masking or relocating it. Data discovery can help financial institutions remediate any data that is found outside the authorized areas, including data that is outdated, inaccurate, irrelevant or excessive. This can also help to minimize the data footprint, lower data-exposure risks, and reduce data storage and maintenance costs.
• Maintain an accurate and up-to-date inventory of data assets and processing activities. Data discovery can help financial institutions keep track of their data assets and processing activities, such as data collection, storage, processing and data sharing, providing a comprehensive and holistic view of their data landscape. This can also help them monitor and audit their data quality, accuracy and completeness, and satisfy data retention obligations.
• Demonstrate accountability and transparency to regulators and customers. Data discovery can help financial institutions demonstrate their accountability and transparency to their regulators and customers by providing evidence of their data inventory and data management capabilities. This can help them respond to data requests, inquiries or complaints from regulators and customers, as well as supporting the mandatory notification requirements in the event of a cyber-incident or data breach.

The imperative for robust data discovery mechanisms within financial services cannot be overstated, as a pivotal tool for navigating the complexities of legal and regulatory compliance, and underpinning cybersecurity and data protection.

Data discovery offers an opportunity to financial services to streamline the challenging process of identifying and managing sensitive data assets across the organization, mitigating data risk while enhancing customer trust.

To capitalize on the benefits of data discovery, financial institutions should:

• Prioritize data governance by establishing clear policies and procedures for data management.
• Invest in robust data discovery tools that offer comprehensive scanning and analysis capabilities.
• Foster a culture of data awareness within the organization to ensure that all stakeholders understand the importance and utility of data discovery.
• Regularly review data discovery processes to keep pace with evolving regulatory requirements and technological advancements.

Incorporating these practices will not only streamline compliance processes for financial services organizations, but also enhance trust with their customers and employees. Ultimately, choosing to invest in data discovery is a testament to an organization’s dedication to safeguarding its most valuable asset — data.

Download your copy of our free eBook How to Choose a Data Discovery Solution, or schedule a call with one of our experts at a time that suits you, to find out more.