Data Protection in Digital Banking — Complete Explainer

Digital banking processes Special Category + Financial Data — account numbers, PAN, biometrics, transaction patterns — which under all regimes is treated as high-risk. So protection is not just IT security, it's a licensed obligation.

1. Why It's Different From Normal Data Protection

• PSD2 + GDPR Interlock: PSD2 forces banks to open account data via APIs to Third Party Providers (TPPs). GDPR says you need explicit consent + data minimization for that same data. A security failure on an Open Banking API is no longer just a payments risk; it immediately becomes a high-stakes GDPR failure.
• Zero Trust Assumption: RBI's new directions mandate at least two distinct authentication factors, with at least one dynamic unique for each transaction. Older versions of mobile banking apps must be phased out within 6 months.
• Regulatory Overlap: One cookie on a banking portal faces questions from GDPR, RBI, PCI DSS, PSD2, DORA and DPDP Act simultaneously.

2. Regulatory Obligations

A. RBI India — 2025-2026 Framework

1. Gap Assessment (GAICA) Report: Banks launching new transactional digital banking services must submit Gap Assessment and Internal Controls Adequacy report.
2. Digital Lending Guidelines: Regulated entities cannot store borrower's data, except basic minimal information. No blanket consent — customer must choose which specific data points are shared and for what purpose.
3. Data Governance Framework Draft 2024-25: Must cover lifecycle, quality, classification, metadata, lineage, third-party arrangements; and be in line with DPDP Act 2023 and DPDP Rules 2025. Board must oversee DGF.
4. Digital Payment Security Directions (Effective April 1, 2026): Backed-up data must be tested at least once every six months, device binding, remote-access app detection, secure app installation, minimum customer data collection, end-to-end encryption.
5. KYC/AML + IT Act + DPDP: Banks must obtain explicit customer consent, ensure transparent terms, network-independent mobile banking, strong risk mitigation controls, regular cybersecurity audits and immediate breach reporting to RBI.

B. EU — GDPR + PSD2 + DORA

• GDPR: Up to €20m or 4% global turnover. Requires Data Minimization, explicit consent, data portability, 72-hour breach notification, Privacy by Design.
• PSD2: Strong Customer Authentication (SCA), open standards, liability allocation. Fines up to 10% yearly net turnover for PSPs in Belgium, €50k per day non-compliance.
• DORA — Digital Operational Resilience Act (Regulation EU 2022/2554, applicable Jan 17, 2025): Sets rules for protection, detection, containment, recovery. Fines up to 2% of total annual global revenue or up to EUR 10m for banking sector.

C. India DPDP Act 2023
Financial data is personal data. Banks are Data Fiduciaries. Must provide purpose-limited notice, verifiable consent, storage limitation (erase once purpose complete), breach notification to Data Protection Board + users. Penalty up to ₹250 Crore per violation, minimum ₹50 Crore. Significant Data Fiduciaries must appoint India DPO, conduct DPIA.

D. US OCC
Obligations for risk assessment before cloud migration, effective risk management.

3. Case Laws / Enforcement — Banking Specific

Case 1: Capital One — US — 2019 Breach — $80M OCC Fine + $190M Class Action
Breach affected 106 million customers — 140k SSNs, 80k bank account numbers. Attacker exploited misconfigured WAF on AWS to access credit card application data from 2005-2019.
In August 2020, OCC assessed $80M civil money penalty. OCC found Capital One failed to establish effective risk assessment processes prior to migrating significant IT operations to public cloud, and failed to correct known deficiencies in cybersecurity program.
Total direct losses exceeded $300M: $72M breach expenses + $80M fine + $190M settlement fund. This was first significant OCC penalty for cloud-related breach.

Lesson: Cloud migration without lineage + risk assessment = unsafe practice.

Case 2: Intesa Sanpaolo — Italy — March 2026 — €31.8M ($36M)
Italy's data protection authority fined country's biggest bank Intesa Sanpaolo 31.8 million euro over data breach involving 3,573 customers. An employee accessed banking information carrying out more than 6,600 consultations between Feb 2022-Apr 2024.

Lesson: Insider access controls, purpose limitation for employee access. Even with encryption, lack of access monitoring violates Art 32.

Case 3: CaixaBank — Spain — 2024 — €6.2M Total
Spanish DPA (AEPD) issued two fines totaling €6.2M against CaixaBank for inadequate security measures. Part of trend: Financial services enforcement expanding sharply in 2024. Average breach notifications increased to 363 in 2024 from 335.

Case 4: Bank Kerjasama Rakyat Malaysia (BKRM) — Malaysia — 2024 — $247k
Bank Negara Malaysia imposed administrative monetary penalty MYR 1M for cybersecurity and data control issues after external party gained unauthorized access to bank's IT infrastructure.

Case 5: Equifax (Reference) + Open Bank S.A.
Equifax settled up to $700M for 2017 breach. Spanish DPA fined Open Bank S.A. €2.5M for insufficient technical and organisational measures to ensure information security — complaint after bank asked proof of origin for AML.

Case 6: Kerala High Court / Bombay High Court — India Zero Liability
Courts held customer has zero liability in third-party breach unauthorized transactions if reported within 3 working days — as per RBI circular. Retiree lost Rs 3.7 lakh to cyber fraud, Court ordered SBI to refund Rs 3.73 lakh. Case: Jaiprakash Kulkarni vs Banking Ombudsman.

4. What a Compliant Digital Banking Architecture Must Have

1. Data Minimization at Source: RBI digital lending rule — cannot store borrower data beyond minimal. Implement tokenization, not raw PAN storage.
2. Strong Customer Authentication: PSD2/RBI 2026 — 2 factors, one dynamic OTP/biometric, device binding.
3. End-to-End Lineage + Encryption: Application-level encryption + TLS, encryption of data at rest, tested backups every 6 months.
4. Consent Dashboard: Granular purpose-based consent, not blanket. User can revoke per purpose.
5. Real-time Fraud Monitoring + Access Anomaly: Detect if employee queries 6,600 accounts like Intesa case — UEBA.
6. Breach Playbook: 72-hour GDPR notification, immediate RBI reporting, DPDP Board notification.