Applying privacy rules to client and portfolio data

The three rulebooks you cannot ignore

You are juggling privacy law and sector-specific data law at the same time. They overlap and sometimes conflict.

GDPR (General Data Protection Regulation) is the EU's privacy law, enforced by national Data Protection Authorities (for example the CNIL in France, the ICO in the UK under the near-identical UK GDPR). It governs any "personal data" about an identifiable person: names, passport numbers, and crucially beneficial ownership details that point to a real human. Fines reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.Voir la définition complète → up to 4% of global annual turnover.

CCPA/CPRA (California Consumer Privacy Act, amended by the California Privacy Rights Act) gives California residents rights to know, delete and opt out of the sale or sharing of their personal information. Enforced by the California Privacy Protection Agency and the state Attorney General. It applies to your US clients even if your fund sits in New York.

MiFID II (Markets in Financial Instruments Directive II) is EU financial regulation. Its data angle: it *requires* firms to retain records of client orders, communications and suitability assessments for at least five years (and up to seven where a national regulator demands it). Similar retention duties exist in the US under SEC Rule 17a-4 and FINRA rules.

Here is the tension in one sentence: GDPR says minimize and delete, MiFID II and SEC rules say retain. A client invoking their "right to erasure" cannot wipe a trade record you are legally bound to keep. You honor the retention obligation, document why, and delete only the data that falls outside it.

Follow the data: one client, three systems

Picture Maria, a client of an EU-based asset manager, invested through a discretionary mandate.

Stop 1: the CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.Voir la définition complète →

Your CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.Voir la définition complète → holds Maria's contact details, risk profile, and a note that she is a "politically exposed person" adjacent (a family member of a public official). Under GDPR that PEP flag is sensitive context data. Check: who in the firm can see it? Access should be role-based, not "everyone in sales."

Stop 2: The KYC and beneficial ownership file

Maria invests through a holding company. Her KYC file maps the UBO (Ultimate Beneficial Owner): the real human who ultimately owns or controls the entity, typically above a 25% threshold under EU anti-money-laundering rules. This is personal data about Maria *and* about her co-owners.

The trap: UBO data collected for anti-money-laundering purposes cannot be freely reused for marketing. GDPR's purpose limitation principle means data gathered for one stated reason stays tied to that reason.

Stop 3: The custodian

Your custodian (think State Street, BNY, or Northern Trust) holds the assets and receives Maria's holdings and identity data to settle trades. This is a cross-controller transfer. You need a data processing or controller-to-controller agreement specifying what they may do with it.

If the custodian's servers sit in the US, you have added an international transfer. Post-2023 this runs through the EU-US Data Privacy Framework, or Standard Contractual Clauses if the vendor is not self-certified. Check: confirm the vendor's certification status before data leaves the EU.

Stop 4: The reporting vendor

A third-party vendor pulls Maria's holdings to generate her quarterly report. Here the vendor is a processor: acting only on your instructions. GDPR Article 28 requires a written contract binding them to your instructions, security standards and deletion obligations.

The most common real-world leak is not a hacker. It is a spreadsheet of client holdings emailed unencrypted to a vendor analyst, or a test environment loaded with real production data.

Data governanceData governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.Voir la définition complète →: who owns what

Governance is deciding, in writing, who is accountable for each dataset.

• Data controller vs processor. You (the asset manager) are usually the controller: you decide why and how data is processed. Custodians and reporting vendors are often processors, though a custodian can be a co-controller for its own regulatory records. Getting this label right determines who is liable.
• Data lineage. A documented mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète → of where each field originates, who it flows to, and why. If your regulator asks "where does Maria's UBO data go?", you should answer in minutes, not weeks.
• Retention schedule. A table pairing each data type with its legal retention period and its deletion trigger. Trade records: at least five years (MiFID II). A rejected prospect's marketing data: delete far sooner.
• RoPA (Record of Processing Activities). GDPR Article 30 requires most firms to keep this inventory of processing activities. It is also the single most useful governance artifact you can build.

The UK ICO publishes a plain-language guide to accountability and governance worth bookmarking.

Practical checks and audits to run

Governance on paper means nothing without recurring checks. Here is a working set.

1. Access review (quarterly)

Pull the list of everyone with read access to KYC and holdings data. Flag anyone who changed roles or left. Over-provisioned access is the top audit finding in asset management privacy reviews.

2. Data flowData flowAn automated sequence of steps that moves data from source to destination: ingestion, transformation, validation, and loading, so it arrives clean and ready to use.Voir la définition complète → reconciliation

Compare your documented lineage to reality. Query your systems: does the reporting vendor actually receive only the fields your contract permits?

A simple check on an outboundoutboundProactive outreach that pushes your message to targeted audiences through advertising, email, or direct prospecting, initiated by the seller rather than the buyer.Voir la définition complète → data extract:

If leaked returns {"passport_number", "ubo_name"}, you just caught a privacy incident before it left the building.

3. Retention sweep

Run a query for records past their retention period with no legal hold. Trade data inside the five-year MiFID II window stays; a prospect who never converted and whose data is three years old and outside any retention duty should be purged.

4. Subject rights readiness

Time a mock DSAR (Data Subject Access Request): a client asking for all data you hold on them. GDPR gives you one month. If you cannot assemble Maria's data across CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.Voir la définition complète →, KYC and vendor systems inside that window, fix the lineage first.

5. Vendor and transfer audit

Annually confirm each processor's security certifications, Data Privacy Framework status and sub-processor list. Custodians and reporting vendors change sub-processors; you are still accountable.

When the rules collide: worked scenario

Maria emails: "Delete everything you hold on me. I am exercising my right to erasure."

Walk it through:

1. Trade and order records from the last five years: retain. MiFID II record-keeping is a legal obligation, a valid GDPR ground to refuse erasure. Document the refusal and the reason.

2. KYC/UBO file: retain for the anti-money-laundering statutory period (commonly five years after the relationship ends under EU AML rules), then delete.

3. Marketing preferences and CRM soft data not tied to a legal duty: delete, and confirm to Maria within one month.

4. Copies at the reporting vendor: instruct the processor to delete their copy of the deletable data, and get confirmation.

Notice the answer is never "delete all" or "keep all." It is a field-by-field decision driven by your retention schedule. That schedule is the governance backbone that makes a stressful request routine.

Key Takeaways

• Retention beats erasure where the law demands it. MiFID II and SEC Rule 17a-4 retention duties override a client's GDPR erasure request for regulated records. Decide field by field, and document the refusal.
• Label every party correctly. Controller versus processor determines liability. Custodians and reporting vendors need Article 28 contracts and, for US servers, a valid transfer mechanism like the EU-US Data Privacy Framework.
• UBO and KYC data is purpose-locked. Data gathered for anti-money-laundering cannot be reused for marketing. Purpose limitation is a frequent, avoidable breach.
• Run the five checks: access review, data flowdata flowAn automated sequence of steps that moves data from source to destination: ingestion, transformation, validation, and loading, so it arrives clean and ready to use.Voir la définition complète → reconciliation, retention sweep, DSAR readiness, and vendor/transfer audit. A field-level check on outboundoutboundProactive outreach that pushes your message to targeted audiences through advertising, email, or direct prospecting, initiated by the seller rather than the buyer.Voir la définition complète → extracts catches leaks before they leave.
• A RoPA plus a retention schedule turns chaos into routine. If you cannot trace Maria's data across CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.Voir la définition complète →, custodian and vendor in minutes, that is your first project.