Information security frameworks for assisting GDPR compliance in banking industry

Abstract

Purpose Data can nowadays be seen as the main asset of organizations and data leaks have a considerable impact on the organization’s image, revenues and possible consequences to the affected clients. One of the most critical industries is the bank. Information security frameworks (ISF) have been created to assist organizations and other frameworks evolved to update these domain practices. Recently, the European Union decided to create the general data protection regulation (GDPR), applicable to all organizations dealing with personal data of citizens residing in the European Union. Although considered a general regulation, GDPR implementation needs to align with some industries’ laws and policies. Especially in the Bank industry. How these ISF can assist the implementation of GDPR is not clear. Design/methodology/approach The design science research process was followed and semi-structured interviews performed. Findings A list of practices to assist the bank industry in GDPR implementation is provided. How each practice map with assessed ISF and GDPR requirements is also presented. Research limitations/implications As GDPR is a relatively recent subject, it is hard to find experts in the area. It is more difficult if the authors intend to find experienced people in the GDPR and bank industry. That is one of the main reasons this study does not include more interviews. Originality/value This research provides a novel artefact to the body of knowledge. The proposed artefact lists which ISF practices banks should implement to comply with GDPR. By doing it the artefact provides a centralized view about which ISF frameworks (or part of them) could be implemented to help banks comply with GDPR.

The ISO/IEC 27001 information security management standard: literature review and theory-based research agenda

“…before the GDPR publication, while the new regulatory requirements were included in the new ISO/IEC 27552 (Privacy Information Management). Nevertheless, previous research has highlighted similar requirements between the GDPR and ISO/IEC 27001 (Annarelli et al , 2020) as well as the fact that a structured ISMS is a prerequisite to meet the European directives (Serrado et al , 2020).…”

“…Japan, Australia) initiatives fostering the diffusion of ISO/IEC 27001 (e.g. Lomas, 2010; Dionysiou, 2011; Serrado et al , 2020). Other studies highlight higher adoption in offshored countries – e.g.…”

How does a data strategy enable customer value? The case of FinTechs and traditional banks under the open finance framework

“…Data and Technology are becoming pivotal assets for organisations, in innovation and to benefit their consumers (Serrado et al 2020;European Commission 2021a).…”

“…Broader data protection regulations, such as the European General Data Protection Regulation (GDPR), sets new challenges for processing sensitive data, (Schulz et al 2021) in order to offer more personalised services that fit the customers' specific needs (European Commission 2020). Broader data protection also implies multiple and simultaneous access to data, with employee roles and responsibilities still evolving (Serrado et al 2020).…”

Information Privacy Assimilation

“…The three research disciplines mentioned above are closely related, influencing each other (Smith et al, 1996;Rose, 2019;Serrado et al, 2020;Rath and Kumar, 2021). Organizations need to leverage these three key research areas.…”