# Applying privacy rules to client and portfolio data
A single high-net-worth onboarding can spawn 40 or more data copies. The client's passport scan sits in your CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition → (Customer Relationship ManagementCustomer Relationship ManagementCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition → system), their beneficial ownership chart lives in a KYC (Know Your Customer) file, their holdings flow nightly to a custodian, and a reporting vendor pulls a slice of everything to build quarterly statements. Each hop is a moment where GDPR, CCPA or MiFID II can bite. This lesson traces that flow and shows you the checks that keep it clean.
You are juggling privacy law and sector-specific data law at the same time. They overlap and sometimes conflict.
GDPR (General Data Protection Regulation) is the EU's privacy law, enforced by national Data Protection Authorities (for example the CNIL in France, the ICO in the UK under the near-identical UK GDPR). It governs any "personal data" about an identifiable person: names, passport numbers, and crucially beneficial ownership details that point to a real human. Fines reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → up to 4% of global annual turnover.
CCPA/CPRA (California Consumer Privacy Act, amended by the California Privacy Rights Act) gives California residents rights to know, delete and opt out of the sale or sharing of their personal information. Enforced by the California Privacy Protection Agency and the state Attorney General. It applies to your US clients even if your fund sits in New York.
MiFID II (Markets in Financial Instruments Directive II) is EU financial regulation. Its data angle: it *requires* firms to retain records of client orders, communications and suitability assessments for at least five years (and up to seven where a national regulator demands it). Similar retention duties exist in the US under SEC Rule 17a-4 and FINRA rules.
Here is the tension in one sentence: GDPR says minimize and delete, MiFID II and SEC rules say retain. A client invoking their "right to erasure" cannot wipe a trade record you are legally bound to keep. You honor the retention obligation, document why, and delete only the data that falls outside it.
Picture Maria, a client of an EU-based asset manager, invested through a discretionary mandate.
Your CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition → holds Maria's contact details, risk profile, and a note that she is a "politically exposed person" adjacent (a family member of a public official). Under GDPR that PEP flag is sensitive context data. Check: who in the firm can see it? Access should be role-based, not "everyone in sales."
Maria invests through a holding company. Her KYC file maps the UBO (Ultimate Beneficial Owner): the real human who ultimately owns or controls the entity, typically above a 25% threshold under EU anti-money-laundering rules. This is personal data about Maria *and* about her co-owners.
The trap: UBO data collected for anti-money-laundering purposes cannot be freely reused for marketing. GDPR's purpose limitation principle means data gathered for one stated reason stays tied to that reason.
Your custodian (think State Street, BNY, or Northern Trust) holds the assets and receives Maria's holdings and identity data to settle trades. This is a cross-controller transfer. You need a data processing or controller-to-controller agreement specifying what they may do with it.
If the custodian's servers sit in the US, you have added an international transfer. Post-2023 this runs through the EU-US Data Privacy Framework, or Standard Contractual Clauses if the vendor is not self-certified. Check: confirm the vendor's certification status before data leaves the EU.
A third-party vendor pulls Maria's holdings to generate her quarterly report. Here the vendor is a processor: acting only on your instructions. GDPR Article 28 requires a written contract binding them to your instructions, security standards and deletion obligations.
The most common real-world leak is not a hacker. It is a spreadsheet of client holdings emailed unencrypted to a vendor analyst, or a test environment loaded with real production data.
Governance is deciding, in writing, who is accountable for each dataset.
The UK ICO publishes a plain-language guide to accountability and governance worth bookmarking.
Governance on paper means nothing without recurring checks. Here is a working set.
Pull the list of everyone with read access to KYC and holdings data. Flag anyone who changed roles or left. Over-provisioned access is the top audit finding in asset management privacy reviews.
Compare your documented lineage to reality. Query your systems: does the reporting vendor actually receive only the fields your contract permits?
A simple check on an outboundoutboundProactive outreach that pushes your message to targeted audiences through advertising, email, or direct prospecting, initiated by the seller rather than the buyer.View full definition → data extract:
# Fields the vendor is contractually allowed to receive
allowed = {"client_id", "portfolio_id", "holding_name", "market_value", "as_of_date"}
extract_columns = set(outbound_file.columns)
leaked = extract_columns - allowed
if leaked:
raise ValueError(f"Extract contains unauthorized fields: {leaked}")If leaked returns {"passport_number", "ubo_name"}, you just caught a privacy incident before it left the building.
Run a query for records past their retention period with no legal hold. Trade data inside the five-year MiFID II window stays; a prospect who never converted and whose data is three years old and outside any retention duty should be purged.
Time a mock DSAR (Data Subject Access Request): a client asking for all data you hold on them. GDPR gives you one month. If you cannot assemble Maria's data across CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition →, KYC and vendor systems inside that window, fix the lineage first.
Annually confirm each processor's security certifications, Data Privacy Framework status and sub-processor list. Custodians and reporting vendors change sub-processors; you are still accountable.
Knowledge check
1. A client formally invokes their GDPR 'right to erasure' on all their data, but the firm has records of their trade orders from two years ago. What is the correct way to reason about this conflict?
2. Why are beneficial ownership details specifically highlighted as a GDPR concern in the context of KYC files?
3. A New York-based fund has several clients who are California residents. Which statement best reflects when CCPA/CPRA applies?
4. Select ALL correct answers about the interplay between privacy laws and financial retention rules described in the lesson.
Select all the correct answers.
5. Select ALL correct answers about why a single onboarding creating many data copies is a privacy risk.
Select all the correct answers.
Maria emails: "Delete everything you hold on me. I am exercising my right to erasure."
Walk it through:
1. Trade and order records from the last five years: retain. MiFID II record-keeping is a legal obligation, a valid GDPR ground to refuse erasure. Document the refusal and the reason.
2. KYC/UBO file: retain for the anti-money-laundering statutory period (commonly five years after the relationship ends under EU AML rules), then delete.
3. Marketing preferences and CRM soft data not tied to a legal duty: delete, and confirm to Maria within one month.
4. Copies at the reporting vendor: instruct the processor to delete their copy of the deletable data, and get confirmation.
Notice the answer is never "delete all" or "keep all." It is a field-by-field decision driven by your retention schedule. That schedule is the governance backbone that makes a stressful request routine.