10.1 What is the applicable data protection regime in
your jurisdiction and what specific implications does this have for
banks?
In the European Union, the protection of personal data is
governed by Regulation (EU) 2016/679 of the European Parliament and
of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the
free movement of such data (GDPR).
The GDPR defines the concept of 'personal data' and
establishes rules relating to the processing of such personal data,
including a number of obligations to be complied with by
controllers and processors of personal data. It:
- sets out the conditions under which the processing of personal
data is deemed to be lawful and principles applicable to personal
data processing (eg, lawfulness, fairness, transparency, purpose
limitation, data minimisation, accuracy, storage limitation,
integrity and confidentiality);
