Is an IBAN personal data? DSGVO classification and practice

At first glance, an IBAN looks like a technical account number. If it is assigned to a natural person, however, it can identify that person directly or indirectly. In that case, the IBAN is personal data within the meaning of the DSGVO. For companies, this does not imply a duty to always redact every IBAN — but it does imply the duty to limit processing, sharing and retention to a legitimate purpose.

Why is an IBAN personal data?

Art. 4 Nr. 1 DSGVO covers all information relating to an identified or identifiable natural person. The Court of Justice of the European Union regularly emphasises the broad interpretation of this concept. A personal IBAN is a unique identifier for a payment account and can be assigned to a person via bank and contract data.

For a purely business account number of a legal entity, the classification can turn out differently. But as soon as the IBAN is linked to a sole trader, freelancer, employee, customer or contact person, there is, as a rule, a personal reference.

Is the IBAN particularly sensitive data?

An IBAN does not automatically belong to the special categories under Art. 9 DSGVO. It nevertheless remains in need of protection. In combination with names, payment purposes and transaction data, account details can produce a detailed picture of financial or private circumstances.

This means: the protective measure depends on context and risk. An IBAN on an invoice to the payer is purpose-related. The same IBAN in a public report, a freely accessible PDF file or a file disclosure can be unnecessary.

When should an IBAN be redacted?

Redaction is sensible when the recipient does not need the complete bank details for their purpose. Typical cases are public documents, disclosure copies containing third-party data, court or authority files, application documents, bank statements used merely as proof of income, and internal reports with a wide circle of recipients.

A practical decision aid:

1. Does the recipient have to execute a payment to this account?
2. Do they have to verify account ownership?
3. Do the last four characters or another form of proof suffice?
4. Will the document be made public, retained permanently or distributed to many people?
5. Does it also contain name, address or sensitive posting texts?

The less the purpose requires the complete IBAN and the larger the circle of recipients, the more strongly Art. 5 Abs. 1 lit. c DSGVO argues for redaction or truncation.

Companies: IBANs in the document workflow

Companies should not look at IBANs only in structured databases. They are frequently embedded in invoices, contracts, email attachments, bank statements and scanned forms. A robust process covers detection, purpose review, human approval, irreversible redaction and documentation.

Datenmaske automatically detects IBAN patterns in PDFs. The suggestions must then be reviewed: on a payment invoice the bank details can be necessary, in a publication they are not. The human decides; the software reduces the search effort.

Also read the practical article Redacting IBANs in PDFs and try the Free-Check on a concrete document.

Conclusion

An IBAN assigned to a natural person is personal data. It does not have to be removed wholesale from every document, but protected with reference to the purpose. Where the complete bank details are not necessary for the recipient, truncation or irreversible redaction is the data-economical solution.