Edited by Antonello Arrè

The new General Data Protection Regulation, known by the acronym "GDPR", will come into force on May 25, 2018. This much-debated regulation, approved by the European Parliament in April 2016, aims to organize data privacy and confidentiality laws across all European countries, while protecting sensitive user data used by companies.

The GDPR represents a significant step forward in the standardization of European policies and data protection. What changes is the extension of jurisdiction to all companies processing personal data of individuals residing in the European Union, regardless of the company's geographic location or the place where the data is managed and processed. Even non-European companies processing data of European citizens will still be required to appoint an internal EU representative.

It is therefore essential for companies to immediately review their internal processes, placing user privacy as a primary concern, ensuring priority and precedence. Furthermore, staff training must be provided to immediately clarify the limits of liability.
A fundamental aspect regulated in the GDPR, in fact, is the concept of Privacy by DesignSpecifically, it establishes that data protection measures must be planned with the relevant supporting IT applications, starting with the design of business processes. This regulation implies that only data that is "truly essential" to the performance of one's professional duties should be processed, and that access to the information should therefore be limited to those users specifically assigned to carry out the processing.

Another important aspect is the Breach Notification, which requires data breach notifications to be mandatory where the breach may put the rights and freedoms of individuals at risk.

Regarding the internal structure of the company itself, with the GDPR the new regulation will give greater prominence to the IT team and the company CEOs, will introduce the figure of the (Data Protection Officer or DPO) (DPO) will be responsible for overseeing the organization's internal processes and acting as an advisor. The DPO will be appointed based on professional qualifications, experience in data protection law and practices, and adequate resources. Oversight of internal data management processes will also be streamlined.

What will the introduction of GDPR mean for banks?
For years, banks have invested enormous amounts of capital in data security and their IT infrastructure. With the continued expansion of digital channels in the financial and banking world, the number and frequency of data breaches are growing.
The constant evolution of threats and the lack of clarity among market leaders likely explains why, despite significant investments, many financial and banking operators lack a balanced security strategy or robust data privacy practices.
The entry into force of the GDPR will highlight breaches recorded at major banks, which will likely be made public shortly after they occur.
Consumers consider trust in banks and the security of their data as essential as their assets. Therefore, they consider trust in the security and confidentiality of their data to be an extremely important factor when choosing a bank.

Despite the importance placed on security and the handling of sensitive financial data, consumers seem to instinctively trust banks without any real reason. The gap between consumer perception and reality is perhaps exemplified by the fact that, despite one in four financial institutions reporting being hit by cyber attacks, few consumers believe their bank has ever suffered such a breach.

It's time, therefore, to take action: with the introduction of the GDPR, banks will have to continue investing in the security of their data and IT infrastructure. Cybersecurity This is the real challenge that awaits the era of digital transformation.