Five Key Legal Requirements And Five Best Practices For Complying With Them

A blog post by Ian Wildgoose Brown published in the WilmerHale FinTech Blog.

Data security and privacy standards for companies in the financial sector are generally well-settled, at least in theory. Companies typically must maintain reasonable procedures to protect sensitive information. In general, applicable law requires a process-based approach to the development and maintenance of a comprehensive security program.

This means that the steps you take as a business to preempt privacy and data security breaches (as well as thoroughly documenting those steps) are of paramount importance in establishing your legal compliance. However, this determination is highly context-specific: whether your security practices are reasonable depends on the nature and size of your business, the types of information you collect or have access to, the data security tools available to you based on your company's resources, and the particular security risks your business is likely to