GDPR Data processing modelCredit risk assessment to define regulatory capital levels and management operations

Organisation: PrivateSector: InsuranceSector: Banking and finance

This processing model relates to the assessment of credit risk to define the level of regulatory capital and management operations in the banking and insurance sector

Purposes (2)

A purpose is the objective pursued by the setting up of your file. It indicates what the processing of personal data will be used for, its purpose. This purpose must be clear and understandable

Definition of the level of regulatory capital corresponding to the level of exposure

Evaluate the credit risk of each customer (natural person) / Develop, periodically check and update the statistical models used to measure the credit risk of natural persons as part of the application of the internal credit risk rating system to retail and professional customers / Calculation of regulatory capital for the Group / Consolidated calculation at Group level / Decision support for granting credit

Legitimate interest

define and implement operations for managing and granting loans according to risk level

Legitimate interest

Data categories (1)

Personal data is any information relating to an identified or identifiable natural person. A natural person can be identified either directly (eg surname and first name) or indirectly (eg phone number, social security number, email or postal address, but also voice or image)

Data required for risk assessment notes

Data details

postal coderequired

Economic situationrequired

Financial situationrequired

Amount of share capitalrequired

Salesrequired

Last balance sheet daterequired

Company creation daterequired

SIC code (Standard Industrial Classification code)required

Company registration numberrequired

Employee Qualityrequired

Economic agent coderequired

Socioprofessional categoryrequired

Professional situationrequired

Agerequired

Family status

required

Name and surnamerequired

Data conservation rules

Active base:

Data used for risk ratings are kept for the duration of the contract. Data needed to build, validate and back-test internal rating models may be kept after the end of the contract, pseudonymised where possible, for as long as required by the data requirements of the IRB approach (historical observation period of at least five years for PD estimation: UK CRR, Art. 180).

UK CRR, Art. 180

Destruction

Data subject (1)

A data subject is any person whose data is collected, retained or processed by the data processing. e.g. In a recruitement process, any candidate for a position proposed in recruitement management process

Customers

Created at:07/08/2023

Updated on:10/05/2026

Nb using:18