Banks and financial service providers
Data protection for banks – client data under control, deletion proven
Banks hold client data in the core banking system, payment processing, lending processes, the CRM and archives – under banking secrecy and with strict retention obligations. Espresso shows where the data is stored and deletes it across all systems once the retention periods have expired, with proof for internal audit and the regulator.
What makes it challenging for banks
Banking secrecy
Client data is not only personal data but is also protected by banking secrecy.
Strict retention
Anti-money laundering records must be retained for at least ten years – after that, any further retention requires a reason.
Critical data
The regulator expects banks to know and protect their critical data.
Many copies
Reporting, the data warehouse, test environments and file storage multiply client data.
How banks use Espresso
- Data Discovery Client data outside the core systems Track down IBANs, credit card and ID document numbers in file storage, databases and Microsoft 365. Go to the module
- Data Deletion Deletion after the end of the business relationship Data that is due is deleted across all connected systems once the retention periods have expired – with a log per deletion run. Go to the module
- Privacy Register Retention periods and deletion holds Retention periods with legal basis, deletion holds (legal holds) for proceedings and official requests. Go to the module
- Privacy Delivery AI without breaching banking secrecy Pass correspondence and dossiers to the AI in pseudonymised form – client names and account numbers stay with you. Go to the module
- Privacy Delivery Test data without client data Substitute values in a valid format for testing and development – banking secrecy is preserved. Go to the module
- Subject Request Access requests from clients On time, complete and with proof of every step. Go to the module
The framework for banks
Data protection, banking secrecy and supervisory law interlock.
| Rule | What it means |
|---|---|
| FADP and GDPR | Register, access requests, erasure, data security. |
| Banking Act (BankA) | Banking secrecy (Art. 47 BankA). |
| Anti-Money Laundering Act (AMLA) | Records must be retained for at least ten years after the end of the business relationship or the completion of the transaction (Art. 7 AMLA). |
| FINMA Circular 2023/1 | Operational risks and resilience at banks, including the handling of critical data. |
| FINMA Circular 2018/3 | Requirements for outsourcing. |
Overview without any claim to completeness; does not replace legal advice in individual cases. As of: 6 October 2026.
Getting started
See within six weeks where your client data is stored
The assessment scans selected sources in your environment – with your real data. The result is a report with clear priorities and a recommendation.
Frequently asked questions
Does our data go to the vendor?
No. Espresso runs in the environment you choose: in your data centre, in your cloud or with an operating partner. Espresso never establishes a connection to the vendor of its own accord – no telemetry, no licence server, no access without your approval.
How do you prevent data from being deleted too early?
Applications can object to a deletion, deletion holds stop deletions for individual cases, and a manual approval by an authorised person can be built into any deletion workflow. A simulation step lets the applications run through the deletion beforehand.
Does Espresso recognise banking identifiers?
Yes: IBANs, credit card and ID document numbers. Custom search patterns add your bank's own client and account numbers.
How is banking secrecy preserved in test environments?
With Privacy Delivery: test data in a valid format, but without real clients.
Related topics
- Find Finding personal data Where personal data is stored in file storage, databases and Microsoft 365 – and how to find it reliably. Read more
- Delete Deletion log and proof of deletion What a proof of deletion should contain and why a spreadsheet is not enough. Read more
- Share Test data without real personal data Realistic test data without real people – and sharing data for a defined purpose. Read more
See Espresso in 30 minutes
We will show you the cockpit with sample data – and discuss where you should start.
Request a demoor write directly to info@espressodataprivacy.com