"We need to ensure regulatory compliance"

The Information Commissioner's Office (ICO) and Financial Conduct Authority (FCA) require businesses to encrypt sensitive data transferred digitally. The ICO can levy fines of up to £17m for non-compliance (or 4% of turnover).

Proof-of-delivery is required by the FCA for certain types of document (e.g., KIDs). The General Data Protection Regulation (GDPR) also steers businesses to use authentication and prevent unauthorised access.

Retaining records is vital for compliance with ICO guidance. The FCA mandates that regulated businesses record all communications and retain proof-of-delivery to the right person for investment documentation.

By law, a data breach must be reported to the ICO within 72 hours. As the ICO notes, having recourse to revoke a sensitive email sent to the wrong person can contain the breach before it reaches the threshold for reporting.

Are you encouraging customers to send their information into your business unsecured? The FCA Consumer Duty is a mandate to provide easy-to-understand communications and protect customers from financial harm.

The FCA's guidance for senior managers (SM&CR) states that they will be held responsible if a breach occurs and they didn't take reasonable steps to prevent it. Individual fines have already been levied up to £321,000.