GDPR Considerations For Community Banks

The May 25, 2018, compliance effective date of the EU's General Data Protection Regulation (GDPR) is just weeks away, and many U.S.-based companies have at least by now taken stock of their EU customer base and operations, and developed a baseline set of compliance plans. For many, that might only entail a data inventory and controls that would ensure that changes to the company's business plan, advertising strategies, and physical footprint would be assessed for GDPR compliance in advance, just as with any other area of compliance. However, for companies whose business relies upon the gathering and use of consumer data, the GDPR implementation process has been onerous.

In particular, as recent American Banker coverage has described, this compliance effort is hitting financial institutions of all sizes hard. While the exact nature and magnitude of enforcement exposure is still unclear, U.S. banks should take a broad view of their overseas business – including where