Study guide
9.3 Data Protection and Data Security
CeMAP Module 1 Financial Services, Regulation and Ethics
Track your progress as you read
Finished sections get a check mark.
1 Introduction
1.1 About the CeMAP Module 1 (FSRE) Exam 1.2 How to Use This Study Guide
2 UK Financial Services Industry and the Wider Economy
2.1 Purpose and Role of Money and Financial Markets 2.2 Structure of UK and International Financial Markets 2.3 Types of Main Markets and Market Participants 2.4 Asset Classes and Their Characteristics 2.5 The UK Government, EU Influence and International Standards 2.6 Bank of England, Financial Institutions and Financial Crime
3 Serving the Retail Consumer
3.1 Consumer Perceptions and Firm Obligations 3.2 Consumer Financial Needs and How They Are Met 3.3 Product Types and Their Functions
4 Legal Concepts for Financial Advice
4.1 Legal Entities and Powers of Attorney 4.2 Law of Contract and Agency 4.3 Property Ownership, Insolvency and Bankruptcy 4.4 Wills and Intestacy 4.5 Trusts: Structure, Purpose and Types
5 Development of UK Financial Services Regulation
5.1 History of UK Regulation 1986–2021 5.2 The UK Regulatory Framework and Other Regulators 5.3 Additional Oversight: Senior Management, Auditors, Trustees and External Compliance
6 The FCA and PRA and Their Handbook
6.1 FCA and PRA: Statutory and Operational Objectives 6.2 Principles-Based Regulation, Duties and Enforcement Powers 6.3 Purpose and Structure of the FCA Handbook 6.4 High-Level Standards and the Training and Competence (T&C) Regime 6.5 Prudential Standards, CASS and the SMCR 6.6 Conduct of Business (COBS) Rules 6.7 Regulatory Processes, Regulated Activities and Authorisation
7 Advising Clients: Skills and Process
7.1 Communication Skills for Advisers 7.2 Gathering Information and the Fact-Find 7.3 Assessment, Analysis and Identifying Appropriate Solutions 7.4 Recommendations, Conclusions and Insistent Clients
8 Principles for Businesses and Conduct Rules
8.1 Principles for Businesses and Conduct of Business Rules 8.2 Preventing Harm, the Market Conduct Code (MAR) and Conduct Risk 8.3 Corporate Culture, Leadership and Senior Management Responsibilities 8.4 Consumer Rights and Unfair Contract Terms
9 Regulatory Framework Rules and Consumer Protection
9.1 Record Keeping, Reporting and Notification Requirements 9.2 Anti-Money Laundering and Proceeds of Crime 9.3 Data Protection and Data Security 9.4 Complaint Handling and the Financial Ombudsman Service 9.5 FSCS, Treating Customers Fairly and Conduct Risk
10 The Regulatory Advice Framework
10.1 Client Relationships, Adviser Responsibilities and Types of Clients 10.2 Fiduciary Relationships and Types of Service Provision 10.3 Disclosure Requirements and Adviser Charging 10.4 Limitations to Authority, Cancellation Rights and Vulnerable Clients 10.5 Regulated Advice Standards and Due Diligence on Products 10.6 Monitoring and Reviewing Client Circumstances
11 Ethics and Professional Behaviour
11.1 Core Ethical Theories, Principles and Values 11.2 Impact of Ethical Principles and Professional Codes of Conduct 11.3 The Code of Ethics and Resolving Ethical Dilemmas 11.4 Business Ethics, Whistleblowing and Ethical Culture 11.5 Professionalism, CPD and Ethical vs Compliance-Driven Behaviour
9.3 Data Protection and Data Security
Key Takeaways Explain This Topic AI
UK GDPR and DPA 2018 are built on seven principles including lawfulness, fairness, transparency and accountability
Lawful bases under Article 6 are required for all processing; special category data needs an Article 9 condition
Personal data breaches likely to risk individuals' rights must be notified to the ICO within 72 hours
SYSC 13 complements the UK GDPR by requiring technical and organisational security measures
PECR requires consent for non-essential cookies and electronic marketing, with a soft opt-in for existing similar-product customers
Last updated: July 2026
9.3 Data Protection and Data Security
Personal data is one of the most valuable assets a financial services firm holds. Customers trust advisers with their income details, health information, account numbers and life plans. UK data protection law has two layers: the UK GDPR (the retained EU General Data Protection Regulation, as amended), and the Data Protection Act 2018 (DPA 2018) , which supplements the UK GDPR and provides the UK's specific framework. The regulator is the Information Commissioner's Office (ICO) .
The Seven Data Protection Principles
The UK GDPR is built around seven principles set out in Article 5. They are not legalistic hurdles but design principles — firms must show they have considered each one in every processing activity.
- Principle In plain terms
- 1. Lawfulness, fairness and transparency Have a valid legal basis and tell people what you do
- 2. Purpose limitation Use data only for the purpose you collected it for
- 3. Data minimisation Collect only what you need
- 4. Accuracy Keep data accurate and up to date
- 5. Storage limitation Keep data no longer than necessary
6. Integrity and confidentiality (security) Protect data with appropriate technical and organisational measures
7. Accountability Be able to demonstrate compliance with the other six principles
The accountability principle is the most distinctive feature of the modern framework — it is not enough to comply; firms must be able to evidence their compliance through policies, records of processing activities (ROPAs), privacy notices, DPIAs and training logs.
Data Subject Rights
The UK GDPR gives individuals (data subjects) specific rights:
The right to be informed (privacy notices).
The right of access (subject access requests, free of charge in most cases, response within one month).
The right to rectification of inaccurate data.
The right to erasure (the right to be forgotten) — subject to exemptions such as legal compliance and legal claims.
The right to restrict processing .
The right to data portability .
The right to object to processing based on legitimate interests or direct marketing.
Rights in relation to automated decision-making and profiling , including the right not to be subject to a decision based solely on automated processing that significantly affects them.
Lawful Bases and Special Category Data
Every processing activity must rest on at least one lawful basis set out in Article 6:
Consent — freely given, specific, informed and unambiguous.
Contract — necessary to perform a contract with the data subject.
Legal obligation — e.g., AML record-keeping obligations under MLR 2017.
Vital interests — to protect someone's life.
Public task — exercise of official authority.
Legitimate interests — a balance between the firm's interests and the data subject's rights.
For special category data (Article 9) — health, racial or ethnic origin, religious beliefs, biometric data, sexual orientation — a further condition is required (e.g., explicit consent, or necessary for insurance purposes with safeguards). Financial advice files frequently contain health information for life insurance and critical illness underwriting, so this second tier is highly relevant.
Data Security — SYSC 13
The FCA's SYSC 13 sourcebook complements the UK GDPR's security principle. Firms must:
Take appropriate technical and organisational measures to safeguard information, including encryption, access controls, firewalls and patch management.
Test security regularly (penetration tests, vulnerability scans).
Train staff on cyber risks, phishing and social engineering.
Maintain a business continuity plan that covers data recovery.
Personal Data Breaches — The 72-Hour Rule
A personal data breach is any breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. When a controller becomes aware of a breach that is likely to result in a risk to individuals' rights and freedoms , it must notify the ICO within 72 hours of becoming aware. If the breach is high risk , the affected individuals must also be informed without undue delay. Processors must notify controllers without undue delay. Even where no notification is required, the breach must be recorded in the firm's breach log.
Freedom of Information Act 2000
The Freedom of Information Act 2000 applies to public authorities, not to private financial firms. However, where a firm holds data on behalf of a public body (for example, a contractor processing pension scheme data for a government department), the data may be subject to FOI requests. Advisers should be aware of this when contracting with public-sector clients.
Retention, Cookies and PECR
The UK GDPR's storage limitation principle requires firms to set retention periods tied to the purpose. Advisers typically retain client files for the duration of the relationship plus the SYSC 9 / MLR 2017 retention period (at least five to seven years), then securely destroy or anonymise them.
The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) govern electronic marketing and cookies. Firms must obtain consent before setting non-essential cookies and before sending marketing emails or SMS to individuals. The soft opt-in rule permits marketing to existing customers for similar products, provided they are given a simple opt-out at the point of collection and in every message.
Practical Compliance Checklist
Maintain a Record of Processing Activities (ROPA) .
Issue clear, layered privacy notices to customers at the point of data collection.
Conduct Data Protection Impact Assessments (DPIAs) for high-risk processing such as automated advice tools.
Appoint a Data Protection Officer (DPO) where required by Article 37 (large-scale special category processing is a typical trigger).
Train staff at least annually and on induction, with phishing simulations and breach drills.
Good data protection is more than a compliance exercise — it is part of the trust relationship at the heart of financial advice.