GDPR: A shield for consumers, a shackle for fraud fighters?

This piece argues that GDPR’s ambiguities and hefty penalties have unintentionally constrained banks’ fraud prevention efforts by fostering risk-averse data practices. It emphasizes the need to balance privacy with protection through transparency, purpose limitation, data minimization, documented legitimate interests, regulator engagement, and strong encryption. Drawing on examples from bank privacy notices and Group-IB’s anti-fraud capabilities, it contrasts marketing’s expansive data use with risk teams’ caution and urges clearer, sector-specific guidance in upcoming GDPR revisions to empower effective, privacy-conscious fraud mitigation.