In Short
-
Financial services firms must comply with UK GDPR, PECR and FCA expectations when handling customer data.
-
New laws increase penalties for unlawful direct marketing, making consent and data sourcing critical.
-
Recent ICO fines show that weak security and poor marketing practices attract heavy enforcement.
Tips for Businesses
Review how you collect, use and store personal data, especially sensitive financial information. Check that your cybersecurity measures are up to date and tested. For marketing, only contact individuals where you have clear, valid consent and easy opt-out options. Regular compliance checks and legal advice can help identify gaps before regulators do.
Running a financial services business comes with many important legal and regulatory responsibilities. In addition to meeting strict industry conduct and legal requirements set by the Financial Conduct Authority (FCA), businesses in this sector must comply with data protection rules when handling personal data.
Regulators and customers pay close attention to financial services firms because they handle sensitive information, such as financial data, which could cause serious harm if misused or leaked. Direct marketing rules are also crucial and heavily enforced; businesses in this sector must ensure regulatory compliance. Enforcement actions and fines by the Information Commissioner’s Office (ICO) highlight why businesses must prioritise compliance to reduce risk and reputational damage.
With the Data (Use and Access) Act 2025 introducing specific changes that increase penalties for breaking direct marketing rules, legal compliance is even more important as risks rise. This article explores:
- the importance of strong financial services compliance;
- highlights lessons from enforcement action; and
- offers steps that businesses can take to support compliance with data protection and direct marketing regulations.
The Importance of Financial Services Compliance
Businesses operating in the financial services sector can often process large volumes of personal data, including:
- identification documents;
- financial records;
- transaction histories; and
- credit data.
This information is especially sensitive, so the risks grow if it is misused or exposed. Public trust is also crucial in this industry, as people need to feel confident sharing their financial data with firms.
Businesses must take a strong, tailored approach to financial services compliance with legal rules, including privacy laws. Strong compliance practices can help protect individuals’ data and reduce the risk of regulatory penalties. Poor compliance, on the other hand, can lead to legal, financial, and reputational damage.
Financial services businesses must also comply with direct marketing rules under PECR when carrying out direct marketing. The ICO continues to actively enforce PECR, and businesses should pay particular attention to this area of compliance.
Increasing Risk Under the New Data Act
PECR is a key law that explains the relevant rules for electronic marketing and the use of cookies, and applies alongside the Data Protection Act and UK GDPR.
The Data (Use and Access) Act 2025 raises the maximum financial penalties for PECR breaches from £500,000 to £17,500,000 or 4% of global annual turnover, whichever is higher. The potential for higher fines makes it even more important for businesses to ensure their direct marketing follows the law.
Continue reading this article below the formEnforcement Action and Lessons
Understanding how regulators enforce the rules helps businesses see where problems commonly arise and what to focus on to reduce risk.
Here are some examples from the financial services sector that show what can happen when businesses do not meet their legal obligations:
Example One
In October 2025, the ICO fined a pensions company £6 million (together with an £8 million fine issued to a sister company) following a cyber attack in March 2023. In this case, hackers stole the personal information of approximately 6.6 million individuals. This included data from pension records, which could cause significant risk. Capita was found to have failed to implement appropriate technical and organisational measures.
The ICO found the company lacked adequate security measures to respond to the attack. Key failings included slow responses to high-priority alerts, weak technical safeguards, and unresolved vulnerabilities. This case underscores the importance of robust data security, especially when handling financial data. The ICO highlighted lessons, including the need to regularly monitor suspicious activity and to prioritise security controls. In regard to pension schemes, this case illustrates how important it is to have robust cybersecurity measures in place to prevent risk.
Example Two
In January 2024, a financial services business was fined £50,000 for sending over 31,000 unsolicited text messages without having consent to do so. Many messages contained no opt-out mechanism, and the firm had relied on unverified verbal consent from a third party. The ICO action highlights the risks of sending direct marketing messages illegally and the need for valid consent.
Example Three
In October 2024, two businesses were fined £150,000 for sending more than 7.5 million spam text messages to individuals. Both businesses purchased personal data from third parties without valid consent. Further, the ICO highlighted that the messages had preyed on vulnerable individuals, mentioning that such action can cause further stress.
How to Approach Compliance
Businesses must prioritise financial services compliance with both data protection and direct marketing law rules, as well as all other applicable rules.
You should approach data protection law compliance by assessing how you:
- collect;
- use; and
- store personal data.
As firms often process sensitive financial information, they should consider legal advice to understand the rules that apply and how best to mitigate risks.
Where direct marketing involves personal data, businesses must remember to comply with both UK GDPR and PECR. Regular audits of compliance with direct marketing law can help reduce risk and support compliant marketing campaigns.
This factsheet sets out how your business can become GDPR compliant.
Key Takeaways
Financial services firms must follow the UK GDPR and PECR when handling personal data and carrying out marketing. ICO enforcement cases show that unlawful marketing or weak data security can create serious regulatory, financial, and reputational risks. Getting legal advice can help your business comply with the rules and reduce these risks.
If you need legal assistance with data protection and direct marketing compliance, our experienced privacy lawyers can assist as part of our LegalVision membership. For a low monthly fee, you will have unlimited access to lawyers to answer your questions and draft and review your documents. Call us today on 0808 196 8584 or visit our membership page.
Frequently Asked Questions
Does the UK GDPR apply to financial services firms?
Any financial services firm that processes personal data must comply with the UK GDPR rules. The obligation applies based on the processing of personal data, regardless of size or industry.
Do I need to keep data secure even as a small business?
All businesses must put appropriate security in place – this could include measures such as strong passwords, staff training, and data access controls.
We appreciate your feedback – your submission has been successfully received.
