Sound practices for customer data protection

Our Ref.: B1/15C
B9/29C
4 April 2022
The Chief Executive
All Authorized Institutions
Dear Sir/Madam,
Sound practices for customer data protection I am writing to share with the industry some sound practices with respect to customer data protection observed from a recent round of thematic examinations undertaken by the Hong Kong Monetary Authority (HKMA). The examinations form part of the HKMA’s supervisory response to the elevated risk of data breach amid a growingly challenging cyber landscape. The objective of the examinations was to assess the adequacy and effectiveness of authorized institutions’ (AIs’) customer data protection controls. As stated in the relevant Supervisory Policy Manual modules and other supervisory documents, including “TM-E-1 Risk Management of E-banking” and “Cyber Resilience Assessment Framework (C-RAF) 2.0”, AIs are expected to put in place effective measures to prevent and detect the loss or leakage of customer data throughout the data lifecycle, including classification, access, storage and transmission. The thematic examinations revealed that the AIs examined generally have put in place effective control measures to protect their customer data. For areas that required improvement, the AIs concerned have subsequently taken appropriate remedial actions to strengthen their controls. In the course of the examinations, the HKMA has observed some sound practices for customer data protection. They are grouped into four areas and summarised below for reference:

• 2 -

• Data governance – AIs are expected to put in place proper governance
  frameworks encompassing risk management process and data security strategy over customer data protection. To this end, some AIs have developed a customer data governance framework to i) define the roles and responsibilities of data owners and the three lines of defence; and ii) evaluate the adequacy and effectiveness of the AIs’ control practices for customer data protection. The board and senior management oversee the development of the AI’s data protection strategy and endorse the relevant customer data governance framework.

• Customer data inventory management – AIs should identify and
  document the locations of their customer data residing in different parts of AIs’ networks, systems and premises. A comprehensive customer data inventory provides visibility of the customer data in custody and enables AIs to better manage the risk of data loss or leakage. Some AIs have developed clear policies and procedures for maintaining and updating an effective customer data inventory. The customer data inventory of these AIs is regularly reviewed to ensure completeness and accuracy.

• Controls over transmission and storage of customer data – AIs should
  adopt effective security measures to minimise the risk of data breach when handling customer data in transit, at rest and at end of life. Many AIs have developed effective data security policies to safeguard customer data against unauthorized access or transmission through various channels, including portable storage media. Data loss prevention (DLP) measures are implemented for internal and external communications. The more advanced AIs regularly test the effectiveness of customer data protection controls to ensure they address the changing business environments.

• Physical and logical security controls of customer data – AIs should
  implement proper physical and logical security controls to prevent customer data from unauthorized access or theft. Many AIs have put in place security controls and multi-factor authentication for premises and systems where massive customer data are processed or stored. Details of the above sound practices are set out in the Annex. AIs are expected to regularly assess whether their existing data security controls remain adequate amid rapid developments in the cyber landscape.

• 3 -
  Should you have any questions regarding this circular, please feel free to contact Ms Connie Tse on 2597 0617 or Mr Kevin Yau on 2878 1044. Yours faithfully, Raymond Chan Executive Director (Banking Supervision) Encl.

---

• 1 -
  Annex
  Sound practices for customer data protection The HKMA completed a round of thematic examinations on customer data protection in 2022. This note sets out the sound practices observed in the thematic examinations.

1. Data governance
   Effective data governance and risk management framework – AIs should put in place effective data governance and risk management framework to protect their customer data throughout the data lifecycle in a secure manner. We observed from the thematic examinations that the board and senior management of AIs exercise sufficient oversight of the formulation and implementation of data security strategy covering customer data protection. In particular, the more advanced AIs have established a management committee comprising various representatives from business, risk management and compliance functions to oversee matters related to customer data protection. Some AIs have established an effective governance framework for customer data protection to ensure the roles and responsibilities of relevant departments and staff (e.g. data owner and three lines of defence) are clearly defined and documented. The customer data governance framework covers processes for evaluating the adequacy and effectiveness of the AIs’ control practices such as identity and access management and encryption controls to safeguard customer data against elevated risk of data breach. These AIs also conduct regular assessments to ensure continuous compliance with relevant laws, regulations and their internal policies.
2. Customer data inventory management
   Comprehensive customer data inventory – AIs should identify and document the locations of their customer data residing in different parts of AIs’ networks, systems and premises, in order to facilitate the prevention and detection of loss or leakage of customer data. Some AIs have developed formal policies and procedures to provide guidance on effective maintenance and updating of the customer data inventory. They maintain comprehensive customer data inventory covering all relevant systems and parties including third parties that process or store customer data. A dedicated responsible officer is assigned to coordinate the annual customer data inventory review exercise. The more advanced AIs use a centralised inventory system for recording and tracking

• 2 -
  their customer data. This facilitates reviews of the inventory to ensure completeness and accuracy.

3. Controls over transmission and storage of customer data
   Robust controls over transmission and storage of customer data – AIs should adopt effective security measures to minimise the risk of data breach when handling customer data in transit, at rest and at end of life. Many AIs have developed data loss prevention (DLP) policies and measures for protecting customer data. These policies and relevant rules of DLP, such as coverage and thresholds for alert and monitoring, are approved by senior management and regularly updated to reflect changing business operations. DLP measures are implemented for internal and external communications (e.g. email, cloud storage service and file transfer protocol). Some AIs have also set up monitoring mechanisms on network traffic to detect suspicious activities. Proper use of portable storage media – AIs should take effective measures to address the risk of unauthorized downloading of customer data to portable storage media. We observed that AIs have deployed appropriate security controls including strong encryption and restriction on portable storage media to protect the confidentiality and integrity of customer data stored in these media. Some advanced AIs perform testing of customer data protection controls periodically to assess their effectiveness.
4. Physical and logical security controls of customer data
   Adequate physical and logical security controls – AIs should implement proper physical and logical security controls to prevent customer data from unauthorized access or theft. We noticed that many AIs have put in place various physical security controls (e.g. surveillance cameras and disallowing use of electronic devices) and multi-factor authentication for premises and systems where massive customer data are processed or stored. In terms of access management, access to information assets such as shared folders containing customer data is granted strictly on a need basis and regularly reviewed. A few AIs have implemented dynamic watermarking on screen or printed documents to deter users from sending customer data to third parties without proper authorization. In addition, some AIs perform periodic security assessments of customer data protection through on-site inspections. These assessments cover areas such as network security, physical and logical access controls of AIs’ and service providers’ operating environments.