The fight between privacy and product teams is usually about how much data an AI feature gets. Two respondents argue for giving models the least data that works, and checking vendors before anything is uploaded.

Data privacy is getting harder as fintechs add AI to budgeting tools, support chats and credit checks. Every new feature wants more customer data, which tests data privacy at firms holding some of the most sensitive data there is. As a result, data privacy teams often find themselves saying no to product teams that want full transaction histories. For how customers already share bank data with consent, see our explainer on open banking.

We asked one question: how is your fintech handling customer data privacy as you add AI features, and where do privacy and product teams disagree most? We wanted data protection officers, privacy counsel, CTOs and product leads at fintechs and banks. Real examples mattered more than general principles. Two people answered in this round, and we used both. Neither works at a fintech or bank, so we’ve set their advice against the current rules.

Where data privacy rules have moved

The UK changed its data privacy rules this year. The main data protection changes in the Data (Use and Access) Act came into force on 5 February 2026, DLA Piper explains. Firms no longer need a specific lawful basis before making automated decisions, except where special category data is involved. However, people keep the right to object and to ask for human intervention. The ICO has also signalled that it may focus enforcement on systems without real human oversight.

In the US, California is moving fastest on AI and data privacy. Updated CCPA rules approved in September 2025 require firms using automated decision tools for significant decisions to comply by 1 January 2027, Foley reports. Risk assessments started on 1 January 2026, with attestations due by April 2028. Meanwhile, EU firms still work under the GDPR’s core principles of purpose limitation, data minimisation and accountability.

Give AI features the least data that works

Omer Malik is chief executive of ORM Systems, which provides risk services and IT hardware.

“AI creates a privacy risk when customer data collected for one purpose becomes available for another without clear permission. A fintech may rightly collect transaction histories to assess payment behaviour, but using those same records to train a recommendation model raises separate questions about purpose, consent, retention and access. I’d require a documented data-use assessment before any AI feature goes live, especially when financial information is involved.

The biggest disagreement between privacy and product teams is usually over data access. Product teams want bigger datasets to improve personalisation and accuracy, while privacy teams need to establish whether each data element is necessary and legally permitted. Take an AI assistant that analyses customer transactions to suggest budgeting improvements. The product team might ask for full transaction histories, while privacy reviewers may decide that categorised spending totals over a set period are enough. That difference can cut exposure without losing the feature’s value.

I’d set three release requirements: a documented lawful basis and purpose, data minimisation with controlled retention, and testing that confirms sensitive information can’t leak through model outputs or logs. Under GDPR and UK GDPR, purpose limitation, data minimisation and accountability should shape development from the start. I’d also check vendors’ data-processing terms, deletion procedures, and whether automated decisions bring extra legal obligations.”

Omer Malik, CEO, ORM Systems

His budgeting example is the clearest answer to our question. Categorised totals give an AI assistant enough to suggest savings, while full histories expose every merchant and payee. So data privacy and product value need not clash, as long as someone asks what the model really needs. His point about reuse also matters. Training a model on data collected for another purpose is where data privacy law bites hardest, through purpose limitation.

His note on automated decisions is right, but the UK detail has changed. Since February, the legal basis test has eased, while the rights to object and to human review remain. Still, ORM Systems is not a fintech, and his budgeting case is an illustration, not a feature his firm built. His answer is sound data privacy guidance rather than a real example.

Check the vendor before the upload

Conor Smart is a director at Arklavo, an apparel business that uses AI in customer service and customer records.

“I’m a director at Arklavo, an international ecommerce business selling apparel to customers in the UK, EU and US, so we’re very aware of how much data protection matters. We use AI in customer service and to help manage our CRM, so these questions aren’t theoretical for us.

The tension between privacy and product or marketing teams usually comes down to whether customer data, such as names, email addresses and order history, should go into AI tools for analysis, for example to spot buying trends. Before any team uploads customer data to an AI tool, I’d ask three questions. Do we know where the data will be stored once it’s uploaded? Can we be confident the provider won’t use it to train its own model? And have we got a proper data protection contract in place with them?

If the answer to any of those is no, consider whether the data could be anonymised, or at least pseudonymised, before it goes in. Banks and fintechs typically hold far more sensitive customer data than a retailer like us. So my advice is to make sure GDPR and UK GDPR requirements are properly considered, and safeguards are in place, before introducing AI tools, not after.”

Conor Smart, Director, Arklavo

His three questions are standard data privacy checks for vendors, and the training question is the one many firms skip. However, his original answer treated anonymised and pseudonymised data as the same, so we’ve edited the line. The ICO says pseudonymised data is still personal data for anyone holding the extra information needed to re-identify it.

The EU’s top court added a nuance in September 2025. In EDPS v SRB, it said pseudonymised data may not be personal data for a recipient with no realistic way to re-identify people, Hunton notes. Even so, the firm sharing it still has data privacy duties, including telling customers about the sharing. Arklavo is a retailer, not a fintech, as he says himself.

What works for data privacy in AI features

The two answers point to a clear order of work. First, run a documented data-use assessment before any AI feature goes live, and confirm the purpose matches why you collected the data. Next, ask what the model needs, and use totals or anonymised data where they will do. Then check every AI vendor on storage, model training and contract terms before anyone uploads customer records. Finally, test that sensitive data cannot leak through outputs or logs, and keep human review for automated decisions. Fintechs that share data with partner banks, as in banking-as-a-service, face the same data privacy questions across each link in the chain.

What to watch next

The next year brings firmer rules on AI and data privacy. Watch for the ICO’s planned code of practice on automated decisions, expected later in 2026. In addition, California’s automated decision rules take effect on 1 January 2027, so US fintechs serving Californians have weeks, not months, to prepare. Also watch how EU regulators apply the SRB ruling when firms share pseudonymised data with AI vendors.

Above all, data privacy works best as a design input, not a final check. Teams that agree early on the least data an AI feature needs will ship faster and face fewer arguments at launch.

FintechBits covers payments, banking and fintech developments for readers in the US and UK. This article is for information only and is not financial or legal advice. Views expressed are those of the FintechBits editorial team.