FCA and ICO Clarify GDPR Compliance for Vulnerability Data Sharing

• •FCA and ICO confirm GDPR does not prevent sharing vulnerability data.
• •Financial firms must document and respond to customer vulnerabilities.
• •MorganAsh advocates for robust data systems to manage vulnerability data.

On March 30, 2026, the FCA and ICO issued a joint statement affirming that GDPR does not obstruct the collection and sharing of customer vulnerability data by financial firms. This guidance aims to enhance support for consumers in vulnerable situations while ensuring compliance with data protection laws. The regulators emphasized the need for firms to recognize and document indicators of vulnerability and to collaborate effectively in sharing relevant information. MorganAsh, a customer vulnerability specialist, supports this initiative, advocating for robust data management systems to ensure accurate and secure handling of vulnerability data. The statement reinforces previous guidance from 2015 and aims to alleviate fears surrounding GDPR compliance that have hindered progress in consumer support initiatives. Firms are encouraged to develop structured data formats for better data transfer and management. The initiative is part of a broader effort to improve outcomes for vulnerable customers in the financial sector.