I wanted to understand what elements of financial information need to be protected/encrypted. Understand that information like IBAN, bank account name, bank account number are personal data and need to be protected. Unsure whether the data elements such as bank bic code, bank swift code, bank cc, bank code are personal data?
AFAIK, all those data are personal data and have to be protected according to the laws of your country. For example in France the owner of the data should have the right to:
- know what data you store
- be allowed to fix any incorrect data
- be allowed to have all its data removed from your files if they ask to
- object to processing this data for marketing goals
- object to processing this data for non-service related goals (EU General Data Protection Regulation)
In addition, as they are personal data, you must tell who is able to see them, what they are used for and who is responsable for the data processing (EU regulation). And the GDPR mandates that you describe the technical and organization measures that are applied to implement the data protection principles.
Yet they are not secret data, and provided you comply with the other regulation rules, encryption is not mandatory.
The PCI DSS provides standards for the processes and systems that merchants and vendors use to protect information related to cards (in v4 the virtual cards will join the party as well). This information includes:
Cardholder data such as the cardholder’s name, the primary account number, and the card’s expiration date and security code.
Sensitive authentication data, including magnetic-stripe data, the equivalent data contained on a chip, and PINs.
All such information must be guarded per PCI DSS requirements when in the cardholder data environment (CDE).
Check page 8 from https://www.commerce.uwo.ca/pdf/PCI_DSS_v3-2-1.pdf Next to it, personal data or PII has to obey to GDPR regulation if the owner is EU citizen (neverming wherever the service is provided as a country).