GDPR Data processing modelCredit scoring process
Purposes (3)
A purpose is the objective pursued by the setting up of your file. It indicates what the processing of personal data will be used for, its purpose. This purpose must be clear and understandable
Data categories (7)
Personal data is any information relating to an identified or identifiable natural person. A natural person can be identified either directly (eg surname and first name) or indirectly (eg phone number, social security number, email or postal address, but also voice or image)
Economic and financial situation of credit applicants
Data details
Data conservation rules
Active base:
Where credit is granted: for the duration of the credit agreement, then 6 years after it ends, to establish, exercise or defend legal claims (Limitation Act 1980, s.5). Where the lender is subject to the Money Laundering Regulations 2017, customer due diligence and transaction records are kept for 5 years after the business relationship ends (reg. 40). Where the application is declined or withdrawn: no statutory period applies; the controller should set a short period, e.g. 6 months from the date of the application, based on the need to answer the applicant's questions or complaints about the decision and to detect repeated fraudulent applications. Data used when applying the score may also be kept in pseudonymised form (Article 4(5) UK GDPR) in statistical databases used to build, validate and monitor scoring models, subject to the appropriate safeguards required by Article 84C UK GDPR.
Limitation Act 1980, s.5; Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, reg. 40; UK GDPR, Article 4(5); UK GDPR, Article 84C
Destruction
Data on the characteristics of the credit transaction
Data details
Data conservation rules
Active base:
Where credit is granted: for the duration of the credit agreement, then 6 years after it ends, to establish, exercise or defend legal claims (Limitation Act 1980, s.5). Where the lender is subject to the Money Laundering Regulations 2017, customer due diligence and transaction records are kept for 5 years after the business relationship ends (reg. 40). Where the application is declined or withdrawn: no statutory period applies; the controller should set a short period, e.g. 6 months from the date of the application, based on the need to answer the applicant's questions or complaints about the decision and to detect repeated fraudulent applications. Data used when applying the score may also be kept in pseudonymised form (Article 4(5) UK GDPR) in statistical databases used to build, validate and monitor scoring models, subject to the appropriate safeguards required by Article 84C UK GDPR.
Limitation Act 1980, s.5; Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, reg. 40; UK GDPR, Article 4(5); UK GDPR, Article 84C
Destruction
Banking situation of credit applicants
Data details
Data conservation rules
Active base:
Where credit is granted: for the duration of the credit agreement, then 6 years after it ends, to establish, exercise or defend legal claims (Limitation Act 1980, s.5). Where the lender is subject to the Money Laundering Regulations 2017, customer due diligence and transaction records are kept for 5 years after the business relationship ends (reg. 40). Where the application is declined or withdrawn: no statutory period applies; the controller should set a short period, e.g. 6 months from the date of the application, based on the need to answer the applicant's questions or complaints about the decision and to detect repeated fraudulent applications. Data used when applying the score may also be kept in pseudonymised form (Article 4(5) UK GDPR) in statistical databases used to build, validate and monitor scoring models, subject to the appropriate safeguards required by Article 84C UK GDPR.
Limitation Act 1980, s.5; Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, reg. 40; UK GDPR, Article 4(5); UK GDPR, Article 84C
Destruction
Information on other household members of credit applicants
Data details
Definition
spouse, marital partner, child, parent, other dependent
Data conservation rules
Active base:
Where credit is granted: for the duration of the credit agreement, then 6 years after it ends, to establish, exercise or defend legal claims (Limitation Act 1980, s.5). Where the lender is subject to the Money Laundering Regulations 2017, customer due diligence and transaction records are kept for 5 years after the business relationship ends (reg. 40). Where the application is declined or withdrawn: no statutory period applies; the controller should set a short period, e.g. 6 months from the date of the application, based on the need to answer the applicant's questions or complaints about the decision and to detect repeated fraudulent applications. Data used when applying the score may also be kept in pseudonymised form (Article 4(5) UK GDPR) in statistical databases used to build, validate and monitor scoring models, subject to the appropriate safeguards required by Article 84C UK GDPR.
Limitation Act 1980, s.5; Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, reg. 40; UK GDPR, Article 4(5); UK GDPR, Article 84C
Destruction
Personal situation of credit applicants
Data details
Definition
in the form of married life, friendships, family relationships, professional relationships
Definition
Owner, tenant, lodger, employer, first-time buyer
Definition
Single, married, cohabiting etc.
Data conservation rules
Active base:
Where credit is granted: for the duration of the credit agreement, then 6 years after it ends, to establish, exercise or defend legal claims (Limitation Act 1980, s.5). Where the lender is subject to the Money Laundering Regulations 2017, customer due diligence and transaction records are kept for 5 years after the business relationship ends (reg. 40). Where the application is declined or withdrawn: no statutory period applies; the controller should set a short period, e.g. 6 months from the date of the application, based on the need to answer the applicant's questions or complaints about the decision and to detect repeated fraudulent applications. For online applications, cookies set on the applicant's device are not kept after the applicant has been informed of the lender's final decision (PECR, reg. 6). Data used when applying the score may also be kept in pseudonymised form (Article 4(5) UK GDPR) in statistical databases used to build, validate and monitor scoring models, subject to the appropriate safeguards required by Article 84C UK GDPR.
Limitation Act 1980, s.5; Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, reg. 40; Privacy and Electronic Communications (EC Directive) Regulations 2003, reg. 6; UK GDPR, Article 4(5); UK GDPR, Article 84C
Destruction
Guarantor information
Data details
Definition
Owner, tenant, lodger, employer, first-time buyer
Definition
Single, married, cohabiting etc.
Data conservation rules
Active base:
Where credit is granted: for the duration of the credit agreement, then 6 years after it ends, to establish, exercise or defend legal claims (Limitation Act 1980, s.5). Where the lender is subject to the Money Laundering Regulations 2017, customer due diligence and transaction records are kept for 5 years after the business relationship ends (reg. 40). Where the application is declined or withdrawn: no statutory period applies; the controller should set a short period, e.g. 6 months from the date of the application, based on the need to answer the applicant's questions or complaints about the decision and to detect repeated fraudulent applications. Data used when applying the score may also be kept in pseudonymised form (Article 4(5) UK GDPR) in statistical databases used to build, validate and monitor scoring models, subject to the appropriate safeguards required by Article 84C UK GDPR.
Limitation Act 1980, s.5; Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, reg. 40; UK GDPR, Article 4(5); UK GDPR, Article 84C
Destruction
Score application result data
Data details
Data conservation rules
Active base:
Where credit is granted: for the duration of the credit agreement, then 6 years after it ends, to establish, exercise or defend legal claims (Limitation Act 1980, s.5). Where the lender is subject to the Money Laundering Regulations 2017, customer due diligence and transaction records are kept for 5 years after the business relationship ends (reg. 40). Where the application is declined or withdrawn: no statutory period applies; the controller should set a short period, e.g. 6 months from the date of the application, based on the need to answer the applicant's questions or complaints about the decision and to detect repeated fraudulent applications. Data used when applying the score may also be kept in pseudonymised form (Article 4(5) UK GDPR) in statistical databases used to build, validate and monitor scoring models, subject to the appropriate safeguards required by Article 84C UK GDPR.
Limitation Act 1980, s.5; Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, reg. 40; UK GDPR, Article 4(5); UK GDPR, Article 84C
Destruction
Data subject (2)
A data subject is any person whose data is collected, retained or processed by the data processing. e.g. In a recruitement process, any candidate for a position proposed in recruitement management process
- Customers
- Other
Attribution / Pas d'utilisation commerciale
CC-BY-NC
