CyberGrant TeamJun 11, 2026 4:48:08 PM7 min read

Bank Data Security: DORA, GDPR and File-Centric Protection

9:15

Key takeaways

A bank data breach doesn't only affect the bank. It affects every customer whose name, account number, transaction history, or credit file ends up in the wrong hands.
Stolen banking data rarely gets used immediately. It circulates for months or years in underground markets, sold multiple times and weaponized long after the original incident.
Inside banks, the share of documents outside IT control is structurally higher than senior management tends to assume. It's not an employee behavior problem. It's a badly designed incentive problem.
DORA and the GDPR converge on a requirement many banks still struggle to meet: knowing where their data actually is, including what sits outside the IT perimeter.
File-centric protection embeds security into the document at creation, regardless of where it ends up. It's a direct answer to an architecture problem, not a behavior problem.

We asked Giancarlo Butti, a data governance and banking compliance specialist, to analyze the real operational state of data and document management in Italian banks. The result is a whitepaper you can download for free at the end of this article.

Before getting into the CISO and DPO perspective, it's worth stepping back and looking at the problem from a different angle: the person who has a bank account.

If your bank gets breached, what actually happens to your data?

The honest answer is: it depends on how many documents were out of control, for how long, and who took them.

The data a bank holds on each customer goes well beyond the account balance. It includes identity documents, tax identification, full transaction history, payslips, tax returns, mortgage contracts, property appraisals, and insurance policies: everything needed to build a complete financial profile of a person.

When that data surfaces in a breach, it rarely gets used right away. It enters a secondary market and gets sold multiple times over months or years. Targeted financial identity theft arriving two years after an incident you never heard about is a documented scenario, not a theoretical one.

If you suspect your banking data has been compromised: monitor your statements closely, enable transaction alerts, check periodically whether your email appears in known breach databases (haveibeenpwned.com is a starting point), and treat unusual requests to confirm personal data with suspicion, even when they appear to come from legitimate sources. Post-breach phishing is almost always more targeted than generic phishing, because the attacker already knows who you are.

Consumer protection starts well before any incident, though. It starts with how well the bank governs the documents it holds about you.

If you're responsible for that governance, the rest of this article is for you.

Inside the bank: the questions the whitepaper raises

Giancarlo Butti opens the whitepaper with a pointed question: why do bank employees systematically work around security policies, even when strict controls are in place?

The answer he gives is not the one most people expect. It's worth reading in full. In the meantime, here are three of the questions the whitepaper addresses that bank CISOs and DPOs tend to find most challenging.

How many repositories outside IT control can you actually map?

Butti's analysis documents something that rarely gets written down: the real distance between the data a bank believes it controls and the data it actually governs. Email, network shares, personal PCs, personal cloud storage, generative AI tools used without approved policies. Each one is a perimeter that shifted without anyone formally deciding it should.

The question the whitepaper leaves open is direct: how many of these repositories can you map with confidence today?

Classifying a document isn't enough: what's missing from your governance criteria?

There's a difference between assigning a confidentiality level to a document and ensuring that level is enforced over time, across every device, and at every vendor that receives it. The whitepaper analyzes why that gap is much wider than it looks, and why eIDAS 2 and DORA are raising the bar on both fronts.

Are the retention periods you have in mind actually the right ones?

Banking document retention periods can stretch to fifty years. The whitepaper asks a question that applies to any bank that has digitized its archives: who guarantees those documents will still be readable, intact, and legally valid when they're needed? If you don't have a clear answer, the operational implications are closer than they appear.

Where file-centric protection fits

The questions the whitepaper raises converge on one point: protection can't depend on users choosing the right channel, or on vendors handling documents correctly after delivery. As we cover in depth in our article on why perimeter DLP no longer works, the file-centric model embeds security into the document at creation: persistent encryption, continuous audit trail, real-time post-sharing access revocation.

FileGrant is CyberGrant's platform for secure document protection and sharing: it encrypts every file at creation, controls who can open, edit, or forward it, and maintains that control even after the document has left the corporate network. It can be deployed as a standalone document platform or integrated into existing document management systems to strengthen their cybersecurity without disrupting established workflows. Either way, it satisfies the traceability requirements of DORA and the GDPR, includes Shadow AI protection, quantum-safe encryption (NIST FIPS 203) for documents with decades-long retention requirements, and supports NIS2 secure file sharing requirements. On-premise deployment, zero-knowledge key management.

Giancarlo Butti's whitepaper goes into the detail behind all of these questions: the structural cause of workarounds, the full map of ungoverned repositories, the classification framework that goes beyond confidentiality, retention periods as dynamic attributes, the limits of digitization, and the regulatory overlap between DORA, GDPR, eIDAS 2, and Banca d'Italia's Circular 285. Written for CISOs and DPOs who work in the same institution and often speak different languages about the same problems.

Frequently asked questions

What does a customer actually risk when their bank is breached?

Compromised banking data rarely gets used immediately. It typically enters underground markets and is resold over months or years, making it hard to connect a targeted attack to the original incident. Real-world risks include financial identity theft, targeted phishing (attackers already know your details), fraudulent credit lines opened in your name, and unauthorized access to digital services. Monitoring statements closely, enabling transaction alerts, and checking whether your email appears in known breach databases are basic self-defense measures.

Why do bank employees work around document security policies?

It's not a training or negligence problem. Performance evaluation systems reward operational results, not security compliance. Employees choosing the most convenient channel are responding rationally to the incentives they receive. The right response isn't tighter enforcement: it's designing tools where the fastest path is also the secure one.

What is Shadow AI and why does it matter for bank data security?

Shadow AI refers to generative AI tools employees use outside approved corporate policies. When an employee uploads a confidential document to one of these tools, that content enters third-party systems outside IT control, with consequences on both the security and GDPR compliance fronts. For a deeper look: Shadow AI and the invisible exfiltration channel.

What regulations govern digital document management in banks today?

DORA (EU Regulation 2022/2554), applicable from January 17, 2025, for digital operational resilience and ICT supply chain; Banca d'Italia Circular 285 for data governance and operational continuity; GDPR (EU Regulation 2016/679) for personal data processing; eIDAS 2 (EU Regulation 1183/2024) and EU Implementing Regulation 2025/2532 for electronic signatures and qualified archiving.

How does FileGrant work in a banking document security context?

FileGrant is CyberGrant's platform for secure document protection and sharing. It encrypts every file at creation and maintains control over who can open, edit, or forward it, even after the document has left the corporate network. It can be deployed as a standalone platform or integrated into existing document management systems. It delivers a verifiable audit trail for DORA, Shadow AI protection, real-time post-sharing access revocation, and quantum-safe encryption (NIST FIPS 203) for documents with decades-long retention requirements. On-premise deployment, zero-knowledge key management.