GDPR and financial advice: Putting the right processes in place

The key point to processing personal data on individuals is it must be justifiable to do so. There have to be internal processes in place - part of GDPR's central tenet of ‘privacy by design' - to justify the use of the personal data and to process it accordingly. Subject access requests must be complied with, so it is imperative to map out how these will be done. In theory, they are not too challenging but having the procedures in place beforehand will ensure the correct personal data is provided to the requesting data subject in a timely fashion. If there is no justification for pro...