| Of relevance to: | All FCA-regulated firms |
| Key date: | Applicable from 25 May 2018 |
The Financial Conduct Authority (“FCA”) have stated that compliance with the EU General Data Protection Regulation (“GDPR”) is now a board level responsibility, and that firms must be able to produce evidence to demonstrate the steps that they have taken to comply.
The FCA requirement to treat customers fairly is also central to both data protection law and the current financial services regulatory framework. When the FCA makes rules, it takes into account how such requirements will affect the privacy interests of individuals such as firms’ customers and employees.
The FCA recognises the need for discussions to ensure specific details of the GDPR can be implemented consistently within the wider regulatory landscape.
Accordingly, the FCA and the Information Commissioner’s Office (“ICO”) are working closely together in preparation for the GDPR; one example being a recent jointly hosted GDPR Roundtable with firms and industry bodies to listen to industry concerns.
While the ICO will regulate compliance with the GDPR, this is also something the FCA will consider under its rules. For example, the requirements in the Senior Management Arrangements, Systems and Controls sourcebook lay down obligations for firms to establish, maintain and improve appropriate technology and cyber resilience systems and controls.
The FCA and ICO have stated that they will continue to collaborate in the coming months to address concerns firms raise and support firms’ preparations for the introduction of the GDPR in May 2018.
