GDPR and banking: what your bank is and is not allowed to do with your data
Banks sit on more of your personal data than almost any other business. GDPR constrains what they can do with it. Here is the plain-language summary of your rights.
Your bank holds some of the most sensitive data about you: income, spending patterns, counterparties, locations, device fingerprints. GDPR (General Data Protection Regulation, in force since 2018) sets strict rules on what they can do with this and what you can demand from them.
What they can do by default
Process your transactions. Verify your identity. Monitor for fraud. Comply with anti-money-laundering obligations (this is a legal basis the bank can rely on without your consent). Share data with authorised regulators and tax authorities under law. Store transaction records for the legally required retention period (typically 5 years in the EU, longer in some jurisdictions).
What they need your explicit consent for
Marketing — sending you promotional offers for products you have not asked about. Sharing data with partner companies for commercial purposes. Behavioural profiling that produces decisions with legal or significant effect on you (though "fraud scoring" has its own legal basis). Research use beyond anonymised aggregates.
Your rights
Access: request a copy of every data point they hold on you, with explanations of how it is used. Rectification: correct inaccurate data. Erasure: delete data no longer needed (bounded by legal retention). Portability: receive your data in machine-readable format for migration to another provider. Objection: stop processing based on legitimate interest (not applicable to legal obligations like AML). Non-automated-decision: not be subject to fully automated decisions with significant effects.
Transfers outside the EEA
If your bank uses US-based service providers (common for cloud hosting), the transfer is permitted under the EU-US Data Privacy Framework or Standard Contractual Clauses. Your bank's privacy policy must disclose these transfers.
What to do if you have a complaint
First raise it with the bank's Data Protection Officer (every regulated bank must have one, with public contact details). If unresolved, escalate to the data protection authority of the country where the bank is established — in the Netherlands, that is Autoriteit Persoonsgegevens. The DPA can impose fines up to 4% of annual turnover for serious violations.