What data protection rules apply to a prop firm's trader data?
Quick answer
Data protection law depends on where you and your traders are. If you serve people in the EU or UK, GDPR or UK GDPR applies; many other countries have similar laws. They govern how you collect, store, share and delete personal data, including identity documents from KYC.
Detailed answer
General information, not legal, tax or regulatory advice. Rules differ by country and change over time; confirm your position with a qualified professional before acting on it.
Data you typically hold:
- Name, email and billing details.
- Identity documents and selfies from KYC.
- Trading activity and payout records.
- Website and analytics data.
Core obligations under GDPR-style laws:
- A lawful basis for processing and a clear privacy notice.
- Collecting only what you need and keeping it only as long as needed.
- Security measures and breach notification.
- Contracts with processors such as KYC and payment providers.
- Respecting access and deletion requests, subject to legal retention.
Minimise what each system holds. PropExecutor stores a trader record with a name and email and the trading data for their accounts; identity documents stay with your KYC provider. This is general information, not legal advice.
Practical steps
List every system holding trader data, what each holds and why. That list becomes the basis of your privacy notice and your answer to any data request.
PropExecutor team · Updated
Related questions
All 28 questions in Legal, regulation and compliance · Every category