The General Data Protection Regulation is the EU's comprehensive data-protection law (retained in the UK as the UK GDPR), governing how personal data is processed, consented to, and ported. It is the privacy backbone beneath open banking; the lawful-basis, consent, and data-minimization requirements that any account-data-sharing regime must satisfy, and a right to data portability that predates and reinforces open banking.
GDPR
The General Data Protection Regulation (GDPR) is the privacy law that sits underneath open banking rather than beside it. Open banking moves personal financial data between parties; GDPR (and the retained UK GDPR) governs whether that movement is lawful — the consent, the lawful basis, the minimization, and the individual’s right to port their data.
- A right to data portability - GDPR’s Article 20 gives individuals a right to receive and transmit their personal data, a general-purpose portability right that predates and reinforces the sector-specific open-banking mandates.
- Consent and lawful basis - Every account-information consent in open banking has to rest on a GDPR-valid basis; the consent surface is not just an open-banking artifact, it is a data-protection requirement.
- Data minimization by design - The least-privilege scope models in open-banking APIs are, in part, GDPR’s minimization principle expressed in machine-readable form.
GDPR is why the consent layer matters as much as the contract in my scoring. A regulated data-sharing API is not just an OpenAPI and an auth stack — it is a lawful-basis machine, and the thinness of machine-readable consent surfaces across every banking market I scored is, in part, a GDPR gap as much as an open-banking one.
Referenced in API Evangelist papers
This regulation shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this regulation in the context of a real sector.
The State of UK Banking APIs
The privacy and consent backbone beneath the UK's open-banking data sharing — the lawful basis every AIS consent rests on.
