HKMA Sets Out Sound Practices for Data Protection by Banks

HKMA assessed the adequacy and effectiveness of authorized institutions’ customer data protection controls. The findings reveal that the authorized institutions have put in place effective control measures to protect their customer data; however, some areas still need further improvements. For areas that required improvement, the concerned authorized institutions have subsequently taken appropriate remedial actions to strengthen their controls. In the course of the examinations, HKMA has observed some sound practices for customer data protection, which are grouped into four areas and can be summarized as follows:

• Data Governance—Authorized Institutions should put in place effective data governance framework encompassing risk management process and data security strategy covering customer data protection. The effective data governance framework will ensure that the roles and responsibilities of relevant departments and staff (for example, data owner and three lines of defense) are clearly defined. The framework evaluates the adequacy and effectiveness of the authorized institutions' controls such as identity and access management and encryption controls to safeguard customer data against elevated risk of data breach. Authorized Institutions should also conduct regular assessments to ensure continuous compliance with relevant laws, regulations and their internal policies.
• Customer data inventory management— Authorized Institutions should identify and document the location of their customer data residing in different parts of its networks, systems, and premises, to facilitate the prevention and detection of loss or leakage of customer data. Institutions should develop clear policies and procedures for maintaining and updating an effective customer data inventory covering all relevant systems and parties, including third parties that process or store customer data. The customer data inventory must be regularly reviewed to ensure completeness and accuracy.
• Controls over transmission and storage of customer data— Authorized Institutions should adopt effective security measures to minimize the risk of data breach when handling customer data in transit, at rest and at end of life. The institutions should develop data loss prevention policies and measures that are implemented for internal and external communications (for example, e-mail, cloud storage service, and file transfer protocol). Authorized Institutions should take effective measures to address the risk of unauthorized downloading of customer data to portable storage media.
• Physical and logical security controls of customer data— Authorized Institutions should implement proper physical and logical security controls to prevent customer data from unauthorized access or theft. The institutions should put in place various physical security controls (for example, surveillance cameras and disallowing use of electronic devices) and multi-factor authentication for premises and systems where massive customer data are processed or stored. Authorized Institutions should perform periodic security assessments of customer data protection through on-site inspections covering areas such as network security, physical and logical access controls of operating environments.

Keywords: Asia Pacific, Hong Kong, Banking, Data Protection, Data Governance, Cyber Risk, Internal Controls, Operational Risk, Basel, Cloud Service Providers, Third-Party Arrangements, Regtech, HKMA