Who Verifies the Regulator?

The Revolut data breach wasn't a matter of some hacked server or a leaky S3 bucket. It was about trust. According to *Cybernews* and *Business Matters*, the fintech gave away customer data (which included sensitive Bitcoin transaction histories) to scammers pretending to be a government agency.

We should stop pretending GDPR Article 32 is just a checklist for encryption and MFA. Firms have treated "security of processing" as a technical chore for the CISO for too long. This failure lived in the gap between the legal team and whoever was holding the data; most firms see a mandate, not a risk, when a request hits their inbox from a government email domain.

The point here is subtle but it matters. "Appropriate technical and organisational measures" now has to include verifying who the requester actually is through out-of-band channels. If your process for legal requests begins and ends with an email thread, you didn't design for privacy. You designed for speed.

Some folks will argue that spoofing is too sophisticated to tell a fake government domain from a real one. They'll say the firm shouldn't be punished for being helpful to someone they thought was an authority.

I think that's a weak defense. A legitimate regulatory request is an extraordinary event (not some routine ticket). The fix isn't better email filters, and it's a policy requiring a secondary check before a single row of data leaves the building, like calling a known departmental lead or using an official portal. If you didn't build that checkpoint in, your "privacy by design" was just a slide in a pitch deck.

This creates a mess for the auditors who signed off on Revolut's controls, and when an auditor checks a box saying "Legal Request Process: Documented," they aren't actually checking if that process can survive social engineering. We're heading toward a reality where a written policy isn't enough. Auditors will have to test the human element, or their own professional indemnity insurance will start to feel the heat.

The real fine won't be for "losing" data in the usual way. It'll be for bad governance. The regulator is going to ask why a request for sensitive financial data didn't trigger a manual verification step.

If a fake email from a regulator landed in your inbox today, how many minutes would it take before your team hit 'send'? It's an uncomfortable question for any compliance officer.

Keep an eye on the next batch of ICO or EDPB guidance regarding "administrative security. If they start mentioning identity verification for legal requests, every firm using automated ticket systems for GDPR requests is suddenly exposed.