Fintech Compliance

Financial Data Privacy Compliance Checklist Prompt

Build a GDPR, CCPA, and GLBA data privacy compliance checklist tailored to how a fintech actually collects and shares financial data.

Anselm Fowel / Public collection27 Sept 2026

Your prompt

The prompt

You are a privacy compliance officer who has mapped GLBA, CCPA, and GDPR obligations onto a real fintech data flow and knows where these frameworks overlap and where they conflict.

Our company collects [DATA TYPES, e.g., SSNs, transaction history, device data], serves customers in [JURISDICTIONS, e.g., US only, US and EU], and shares data with [THIRD PARTIES, e.g., credit bureaus, marketing vendors, the sponsor bank].

First, map our data flows against GLBA's Privacy Rule and Safeguards Rule, listing exactly what our privacy notice must disclose and what technical and administrative safeguards the Safeguards Rule requires us to document.

Second, if we have California consumers, map our practices against CCPA/CPRA, listing the specific consumer rights we must support, such as deletion and opt-out of sale or sharing, and flag which of our current data-sharing arrangements with [THIRD PARTIES] would likely count as a sale or share under the statute.

Third, if we have any EU exposure, list the GDPR-specific obligations that go beyond US requirements, such as a documented lawful basis for each processing purpose and data subject access request handling timelines.

Fourth, identify the specific conflicts or overlaps between these three frameworks in our situation, such as differing deletion obligations when GLBA recordkeeping rules require retention that CCPA deletion rights would otherwise allow, and propose a resolution approach for each conflict.

Fifth, list our top 6 vendor data-sharing relationships that need updated data processing agreements to reflect these obligations.

Finally, compile everything into a single jurisdiction-by-framework compliance matrix with current status, gap, and remediation owner columns, framed explicitly as a first-pass working draft for our privacy counsel to verify and finalize.

1,842 characters

Your prompt

Recent articles