Read Part 1 on
Why and how banks are running out of time to implement
GDPR.
Repapering
Central to every bank's compliance efforts will be the
updating of contracts with existing customers and suppliers –
a vast 'repapering' exercise. Like the existing EU
directive, the GDPR targets all firms that act as 'data
controllers' – those who decide how and why data is
processed, a category that covers most financial services firms
– and 'data processors', typically third-party
service providers that handle personal data on behalf of data
controllers.
However, GDPR introduces new requirements for data controllers
to explicitly obtain customers' consent on how their personal
data is retained and used. Along with concerns about the additional
requirements on IT systems to track these consents, some firms fear
they will need completely new contracts in many cases to cover
these permissions.
