The General Data Protection Regulation is the EU's comprehensive data-protection law (retained in the UK as the UK GDPR), governing how personal data is processed, consented to, and ported. It is the privacy backbone beneath open banking; the lawful-basis, consent, and data-minimization requirements that any account-data-sharing regime must satisfy, and a right to data portability that predates and reinforces open banking.
GDPR
Statute European Union / United Kingdom
The General Data Protection Regulation (GDPR) is the privacy law that sits underneath open banking rather than beside it. Open banking moves personal financial data between parties; GDPR (and the retained UK GDPR) governs whether that movement is lawful — the consent, the lawful basis, the minimization, and the individual’s right to port their data.
- A right to data portability - GDPR’s Article 20 gives individuals a right to receive and transmit their personal data, a general-purpose portability right that predates and reinforces the sector-specific open-banking mandates.
- Consent and lawful basis - Every account-information consent in open banking has to rest on a GDPR-valid basis; the consent surface is not just an open-banking artifact, it is a data-protection requirement.
- Data minimization by design - The least-privilege scope models in open-banking APIs are, in part, GDPR’s minimization principle expressed in machine-readable form.
GDPR is why the consent layer matters as much as the contract in my scoring. A regulated data-sharing API is not just an OpenAPI and an auth stack — it is a lawful-basis machine, and the thinness of machine-readable consent surfaces across every banking market I scored is, in part, a GDPR gap as much as an open-banking one.
Reaches these HTTP headers
Where a regulation actually touches the wire. Mandated means the law, or a technical standard it makes binding, names this header. Evidentiary means no law names it, but it is the deployed control for an obligation the law does impose. Inferred means it would be good evidence and nothing requires it — interesting to read, never to score.
access-control-allow-origin
evidentiary
observable at the edge
A negative signal. A wildcard origin on an authenticated surface is a data-protection failure anyone can observe without credentials.
clear-site-data
evidentiary
observable at the edge
Erasure carried out at the client boundary rather than only in the datastore.
