Data sovereignty and privacy in financial services: Adapting faster with data-centric architecture

Kadri Linask-Goode, Global Privacy Lead, Digital Realty
October 18, 2024

In today's rapidly evolving digital landscape, data sovereignty and data privacy in financial services have become critical concerns. Financial services enterprises must navigate a complex web of data privacy regulations and financial data sovereignty laws that vary by country and region to not only maintain trust but remain competitive. IT leaders at global financial services enterprises continuously balance data governance with overarching business objectives that requires an adaptable, flexible, and data-centric IT infrastructure.

The global landscape of data privacy regulations

The United Nations Conference on Trade and Development found that 137 out of 194 countries (or over 70% of countries) have legislation governing the protection of data and privacy. Even further, just in the United States, there are five new state data protection laws going into effect in 2023.

As a result, IT leaders at financial services enterprises should familiarise themselves with an ever-increasing number of financial data privacy laws and evaluate these individually for business and processing impacts.

Understanding data sovereignty vs. data residency

• Data sovereignty: Data is subject to the laws and governance structures within the nation where it’s collected, stored, or processed. This means financial institutions must comply with local data sovereignty laws when handling data within that jurisdiction.
• Data residency: Data has a physical or geographic location where it’s stored. Some countries require that data collected within their borders be stored locally, a practice known as data localisation.

Understanding the difference between data sovereignty vs. data residency is crucial for financial services enterprises as it impacts how they store, process, and transfer data across borders.

Data privacy regulations for financial services enterprises

A few data privacy regulations across the globe include:

• The European Union’s General Data Protection Regulation
• The European Union’s Artificial Intelligence Act
• The Brazilian General Data Protection Law
• Singapore's Personal Data Protection Act 2012
• The California Consumer Privacy Act

In addition to regional data sovereignty laws, new cybersecurity laws and data residency requirements apply specifically to financial services enterprises in key markets.

In the United States, these cybersecurity requirements come from the:

• New York State Department of Financial Services
• Federal Deposit Insurance Corporation
• Gramm–Leach–Bliley Act
• Federal Trade Commission

Regulations increasingly hold global financial services enterprises accountable to individual customers’ local data privacy laws, in addition to the laws governing the jurisdictions in which they operate.

IT leaders find themselves in the challenging position of creating an IT architecture that can adapt to the new regulations and manage the complexity. Data sovereignty in financial services then reinforces the need for a Hybrid IT solution when storing, transferring, and securing data.

The growing importance of cybersecurity in financial services

With the rise of digital transactions, cybersecurity in financial services has become more critical than ever. Financial institutions are prime targets for cyberattacks due to the sensitive nature of the data they handle. Implementing robust financial data security measures is essential to protect against data breaches and comply with cybersecurity regulations like the NYDFS cybersecurity requirements.

A data-centric Hybrid IT strategy enhances cybersecurity by:

• Providing advanced security protocols across all platforms
• Enabling real-time monitoring and threat detection
• Facilitating quick-response mechanisms to mitigate potential breaches

The risks of not proactively responding to data regulations

IT leaders at global financial services enterprises face unique demands and challenges as they adhere to various regional data privacy and sovereignty mandates.

There are two options for managing data:

• Structure the network proactively to compliantly process data to safeguard from regulatory investigations.
• Scramble to follow legislation after it's enacted, increasing the potential for errors and risking regulatory enforcement actions.

Waiting for new regulations and reacting has organisational downsides: it increases the potential for errors, risks regulatory enforcement actions, and adds stress to the business.

Because financial services enterprises manage a massive volume of sensitive data, the risk of significant fines and reputational harm increases with a company’s noncompliance to regulations.

DLA Piper reported in its GDPR Fines and Data Breach Survey that protection supervisory authorities across Europe have issued a total of €1.64 billion EUR ($1.74 billion USD) in fines in 2022 — a 50% year-on-year increase from 2023.

Other regions are also increasing financial penalties: The Personal Data Protection Commission in Singapore revealed in the Enforcement of the Personal Data Protection Act increases to the financial penalty cap from a fixed S$1 million to 10% of an organisation's annual turnover exceeding S$10 million, whichever is higher.

As many countries begin to take data privacy in financial services more seriously, noncompliant enterprises risk significant consequences.

Financial services enterprises that proactively address their IT architecture to meet evolving regulations can avoid the potential of such significant penalties and can compliantly maximise leveraging their data to support their company’s mission and, most importantly, enhance customer value.

Addressing fragmented legacy data architectures

Data management plays a vital role in the financial services sector as robust privacy and data security capabilities become core differentiators and data sovereignty requirements evolve.

A data-centric Hybrid IT strategy includes:

• Localised data storage, especially in countries where applicable data regulations exist
• Hybrid IT controls to address data governance, sovereignty, compliance, and requirements
• Accessible centers of data exchange that interconnect partners, clouds, applications, and ecosystems
• Optimised data exchange to reduce latency and improve performance, mitigating the challenge of Data Gravity

Implementing an effective data governance framework

An effective data governance framework is essential for managing data assets and ensuring regulatory compliance. It involves:

• Establishing clear policies and procedures for data handling
• Defining roles and responsibilities within the organisation for data management
• Implementing data quality controls to ensure accuracy and reliability
• Monitoring compliance with internal policies and external regulations

By integrating a robust data governance framework, financial enterprises can enhance data governance in financial services, reduce risks, and improve decision-making processes.

Making data work for your global financial services enterprise

IT leaders at financial services enterprises can create significant competitive advantages by partnering with an organisation that has a global data center platform.

A clear data-centric Hybrid IT infrastructure enables control of where data is stored, how it’s aggregated, and how it leverages cutting-edge technology to mitigate cyberattacks. This helps position your company to meet ever-changing financial data sovereignty and data privacy requirements with regionalised data storage.

Navigating cross-border data transfer challenges

Effective management of cross-border data transfer is essential for global financial operations. Financial services enterprises must consider:

• Legal implications of transferring data across different jurisdictions
• Compliance with international data transfer regulations, such as Standard Contractual Clauses and Binding Corporate Rules
• Implementing secure data transfer protocols to protect data integrity and confidentiality

A data-centric Hybrid IT strategy facilitates secure and compliant cross-border data transfers by leveraging localised data centres and interconnected networks.

Leveraging data for digital transformation in finance

Digital transformation in finance is propelled by effective data utilisation and regulatory compliance. By adopting a modern financial services IT infrastructure, enterprises can:

• Enhance customer experiences through personalised services.
• Increase operational efficiency with automation and advanced analytics.
• Drive innovation by leveraging big data and artificial intelligence.
• Ensure compliance by integrating regulatory requirements into IT systems.

Embracing digital transformation enables financial services enterprises to stay competitive and meet the evolving needs of their customers.

For example, navigating the complexities of data sovereignty, data privacy, and regulatory compliance in global banking requires a proactive and strategic approach. By implementing a data-centric Hybrid IT strategy, global banking enterprises can address the challenges posed by fragmented legacy systems, comply with diverse regulations, and leverage data as a strategic asset for growth and innovation.

Digital Realty brings companies and data together to power innovation by delivering the full spectrum of data centre, colocation, and interconnection solutions. PlatformDIGITAL®, our global data centre platform, provides customers with a secure data meeting place.

Visit our financial services industry page to learn how PlatformDIGITAL® can help IT leaders unlock growth opportunities and competitive advantages through data-driven transformation.

Author Bio: With 20+ years of compliance experience and nine years in data privacy, Kadri focuses on privacy matters associated with Digital Realty's global customers, staff, suppliers, products, and operations.

FAQs

What is data sovereignty in financial services?

Data sovereignty in financial services refers to the concept that financial data is subject to the laws and governance structures within the nation where it’s collected, stored, or processed. This means financial institutions must store, manage, protect, and transfer data according to the specific regulations of each country, ensuring compliance with local data privacy and protection laws.

Why is data privacy important in the financial services industry?

Data privacy is crucial in the financial services industry because these enterprises handle sensitive personal and financial information. Protecting this data builds trust with customers, ensures compliance with global and regional regulations, and safeguards against legal penalties and reputational damage resulting from data breaches or noncompliance with data protection laws.

What are the key data privacy regulations affecting financial services enterprises?

The key data privacy regulations impacting financial services include:

• General Data Protection Regulation in the European Union
• Artificial Intelligence Act in the European Union
• California Consumer Privacy Act in the United States
• General Data Protection Law in Brazil
• Personal Data Protection Act in Singapore
• Industry-specific regulations like the Gramm–Leach–Bliley Act and directives from the New York State Department of Financial Services

These regulations govern how financial institutions collect, store, process, and transfer personal data.

How can financial services enterprises comply with data sovereignty laws?

Enterprises can comply by:

• Implementing localised data storage to keep data within the jurisdiction where it was collected
• Adopting a data-centric Hybrid IT strategy that allows flexibility and control over data placement
• Establishing robust data governance policies that align with local regulations
• Partnering with global data centre providers like Digital Realty to leverage compliant infrastructure and expertise
  

What is a data-centric Hybrid IT strategy?

A data-centric Hybrid IT strategy combines on-premises, private cloud, and public cloud services to optimise data placement and processing. It focuses on:

• Localised data storage for compliance
• Hybrid IT controls for governance and security
• Interconnected data exchange centres to enhance performance
• Optimised data flow to address challenges like Data Gravity

This approach enables financial institutions to be agile and compliant with varying data sovereignty laws.

What are the risks of noncompliance with data privacy regulations in financial services?

Noncompliance risks include:

• Hefty fines and financial penalties, which can be a percentage of annual turnover
• Reputational damage, leading to loss of customer trust and business
• Legal actions and sanctions from regulatory bodies
• Operational disruptions due to enforced changes or restrictions
• Increased vulnerability to data breaches due to inadequate data protection measures
  

How does Data Gravity impact financial services enterprises?

Data Gravity refers to the phenomenon where accumulating data attracts additional services and applications. In financial services, large volumes of data can:

• Create latency issues if not properly managed.
• Increase complexity in data management and compliance.
• Necessitate optimised data exchange solutions to ensure efficient processing and analysis.
• Impact performance of applications and services reliant on data accessibility.
  

How can financial services enterprises address fragmented legacy data architectures?

Enterprises can:

• Conduct an IT infrastructure assessment to identify fragmentation points.
• Implement a unified, data-centric IT architecture that consolidates data management.
• Leverage Hybrid IT solutions to integrate legacy systems with modern technologies.
• Adopt standardised data governance frameworks to streamline processes.
• Partner with experienced data centre providers to modernise infrastructure efficiently.
  

What is PlatformDIGITAL® from Digital Realty, and how does it help with data sovereignty?

PlatformDIGITAL® is the Digital Realty global data centre platform that provides:

• Secure, compliant data storage solutions across multiple regions
• Interconnection services that facilitate efficient data exchange
• Scalable infrastructure to adapt to evolving data sovereignty laws
• Advanced security measures to protect against cyberthreats

By utilising PlatformDIGITAL®, financial services enterprises can manage data according to local regulations while optimising performance and scalability.

Why should financial services enterprises adopt a proactive approach to data privacy regulations?

A proactive approach allows enterprises to:

• Stay ahead of regulatory changes, reducing the risk of noncompliance.
• Mitigate potential fines and legal consequences by ensuring adherence to laws.
• Enhance customer trust through demonstrated commitment to data protection.
• Improve operational efficiency by integrating compliance into IT strategies.
• Leverage data as a strategic asset to drive innovation and competitive advantage.