Data Protection in Online Banking in the United Kingdom

Abstract

The rise of online banking has fundamentally transformed financial services by increasing accessibility and operational efficiency. However, this transformation has introduced significant challenges concerning the protection of personal data. In light of escalating cyber threats and data breaches, this dissertation critically evaluates the efficacy of existing legal and regulatory frameworks governing data protection in online banking. It begins by outlining the core legal principles underpinning data privacy, including the General Data Protection Regulation (GDPR), the Data Protection Act 2018, and key provisions of the UK's Financial Services legislation. The analysis proceeds to examine how financial institutions implement data protection standards, with particular attention to data minimisation, consent mechanisms, encryption practices, and third-party access. Case studies are employed to highlight persistent vulnerabilities in both regulatory enforcement and corporate compliance, revealing a gap between theoretical protection and practical implementation. It is argued that while the legal framework provides a robust foundation, its fragmented application and reactive enforcement often permit systemic weaknesses to persist. Accordingly, this dissertation asserts the need for enhanced accountability mechanisms, greater regulatory harmonisation, and mandatory cybersecurity certifications for financial technology systems. Through a doctrinal and comparative methodology, it is submitted that reform must strike a balance between technological innovation and safeguarding individual privacy rights. The study concludes that a proactive and unified approach to data governance is essential for maintaining public trust and resilience in the digital banking sector.