Data Protection, Confidentiality and Record-Keeping
This domain tests the Data Protection Act 2019, sector confidentiality and retention periods. The exam often presents a request for customer data and asks whether the firm can disclose it.
Data protection
- The ODPC supervises the DPA 2019. Core principles include lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity/confidentiality and accountability.
- Process only with a lawful basis; honour data-subject rights; register as a controller/processor where required; notify the ODPC of breaches within 72 hours; apply cross-border transfer conditions; appoint a DPO where required.
Confidentiality and records
- Banking Act secrecy, CMA confidentiality and general client confidentiality restrict disclosure; exceptions include regulator requests, court orders and AML reporting.
- AML records must be kept for seven years; tax records for five years; data minimisation means records should not be kept indefinitely without a legal basis. Records must be secure, retrievable and auditable.
Worked example
A foreign regulator asks a Kenyan bank for customer data. The bank cannot simply send it. It checks the legal basis, whether a regulator-to-regulator channel or MoU exists, DPA cross-border conditions and sector-secrecy exceptions; it discloses only the minimum and records the request. AML reporting to FRC is separate and must not be tipped off.
Traps
Relying on consent when another lawful basis exists; missing the 72-hour breach clock; retaining all data indefinitely; sharing with a parent without safeguards; treating an STR as a confidentiality breach.