PSD2 (Payment Services Directive 2) and GDPR (General Data Protection Regulation) are two distinct regulations in the European Union (EU) that address different aspects of data protection and privacy. While they share some overlap in terms of personal data processing, they serve different purposes. Let’s take a closer look.

What is PSD2?

PSD2 is a regulatory framework that aims to enhance competition, innovation, and security in the payment services industry within the EU. It introduces rules for payment service providers (PSPs) and governs various aspects of electronic payments, including account access, payment initiation, and the security of electronic transactions. PSD2 provides a legal framework for open banking, enabling third-party providers to access and utilize customers’ banking data with their explicit consent.

What is GDPR?

GDPR is a comprehensive regulation that governs the protection of personal data and privacy rights of individuals within the EU. It establishes rules for the processing, storage, and transfer of personal data by organizations. GDPR aims to empower individuals by granting them control over their personal data and ensuring that organizations handle it in a transparent, secure, and lawful manner. It applies to a wide range of industries and sectors, not limited to payment services.

Uncovering the overlap between PSD2 and GDPR

PSD2 and GDPR intersect when it comes to the processing of personal data within the context of payment services. Under PSD2, third-party providers may access customers’ banking data, which may include personal information. When accessing and processing this data, these providers must comply with the requirements and principles outlined in GDPR. This means that they must obtain appropriate consent, ensure data security, adhere to data minimization principles, and respect individuals’ rights, such as the right to access and rectify their data.

PSD2 recognizes the importance of data protection and mandates that third-party providers abide by the relevant data protection rules, including GDPR. By aligning with GDPR, PSD2 ensures that individuals’ privacy rights and personal data are adequately protected in the context of open banking and third-party access to payment data.

While PSD2 focuses on enhancing competition and security in the payment services sector, it acknowledges the importance of data protection by requiring compliance with GDPR principles and requirements when processing personal data. This ensures that individuals’ rights and privacy are respected within the framework of open banking and payment services under PSD2.

Safeguard Your Financial Data Today

PSD2 penalties for non-compliance

Non-compliance with PSD2 (Payment Services Directive 2) can result in various penalties and consequences for the entities involved. The specific penalties may vary across EU member states as each country implements PSD2 through its national legislation. Here are some potential penalties associated with non-compliance:

  1. Administrative fines: Competent authorities and regulatory bodies responsible for enforcing PSD2 have the power to impose administrative fines on non-compliant entities. These fines can vary in amount depending on the severity of the violation and the country’s specific regulations.
  2. Suspension or revocation of authorization: Entities that fail to comply with the requirements of PSD2 may face suspension or revocation of their authorization to operate as a payment service provider (PSP). This can result in a significant disruption to the business operations and the loss of their ability to provide payment services.
  3. Compensation claims: Non-compliance with PSD2 can lead to financial losses or damages for consumers or other parties involved. In such cases, affected individuals or organizations may seek compensation through legal channels, potentially resulting in additional financial liabilities for the non-compliant entity.
  4. Reputational damage: Non-compliance with PSD2 can harm an entity’s reputation and erode trust among customers and partners. The negative publicity associated with non-compliance can have long-lasting consequences, leading to a loss of business opportunities and potential customers.
  5. Regulatory interventions and remediation measures: Regulatory authorities may impose additional remediation measures or interventions on non-compliant entities to rectify the situation. This could involve implementing specific corrective actions, enhanced monitoring, or compliance audits, which may incur additional costs and operational burdens.

It is important for entities subject to PSD2, such as payment service providers (PSPs), to understand and comply with the requirements outlined in the regulation to avoid these penalties. Compliance helps ensure the security, transparency, and efficiency of payment services while protecting the rights and interests of consumers.

Data Privacy Journey: The Right Path Toward Compliance - PSD2
Download whitepaper.

PSD2 Strong Customer Authentication

PSD2 Strong Customer Authentication (SCA) refers to a regulatory requirement under the Revised Payment Services Directive (PSD2) in the European Union. It mandates that customers must provide multiple forms of authentication to validate their identity when making electronic payments or accessing their payment accounts. SCA aims to enhance the security of online transactions by adding an extra layer of protection against fraudulent activities, ensuring that only authorized individuals can access and carry out financial transactions.

Rules for non-EU residents’ data under PSD2

PSD2 (Payment Services Directive 2) primarily focuses on regulating payment services within the European Union (EU) and the European Economic Area (EEA). As such, its provisions primarily apply to entities operating within these regions. However, there are certain considerations for non-EU residents’ data under PSD2:

  1. Cross-border transactions: PSD2 covers payment services that involve cross-border transactions, including transactions between EU/EEA member states and countries outside the EU/EEA. In such cases, the data involved in the payment transaction may be subject to the regulations and requirements of both the EU/EEA and the jurisdiction where the non-EU resident resides.
  2. Data protection: While PSD2 does not specifically address non-EU residents’ data separately, it aligns with the broader data protection principles outlined in the EU’s General Data Protection Regulation (GDPR). When processing personal data, including that of non-EU residents, entities must adhere to the relevant data protection rules, ensuring lawful processing, consent requirements, data security, and individuals’ rights.
  3. International data transfers: If payment service providers (PSPs) transfer personal data of non-EU residents outside the EU/EEA, they must comply with the requirements for international data transfers under GDPR. This may involve using appropriate safeguards, such as standard contractual clauses or binding corporate rules, to ensure an adequate level of protection for the transferred data.
Test Drive BigID for PSD2 Compliance

BigID’s approach to PSD2 compliance

BigID is the industry-leading provider in data intelligence solution for privacy, security, and governance. BigID offers a wide range of powerful tools in its Privacy Suite that can assist organizations in achieving PSD2 compliance when handling the financial personal data of EU residents.

Using advanced AI and machine learning, BigID brings automated robust data discovery and classification at scale— for unstructured, structured, and dark data both on prem and across the multi cloud. With BigID, organizations can identify and understand the personal data they possess, including data subject to PSD2 regulations. Accurately and easily track and manage cross-border data transfers, ensuring compliance with relevant data protection laws.

To gain greater visibility and control over all your most sensitive data and achieve compliance with PSD2— schedule a 1:1 demo with BigID today.