When people talk about GDPR in the financial advice world, the focus is usually on advisers.

• Are your processes compliant?
• Are your systems secure?
• Are your teams trained properly?

All valid questions.

But in our experience, the biggest challenge to GDPR compliance for advisers isn’t always internal.

It’s external.

The real issue: inconsistent provider practices

One of the most frustrating (and often overlooked) barriers to GDPR compliance is the inconsistency in how providers handle data protection.

Quite simply, it’s hit and miss.

• Some providers encrypt emails as standard, others don’t
• Some insist on secure portals, others still rely on basic email communication
• Some actively discourage advisers from communicating securely, declining password-protected documents

This lack of consistency creates unnecessary risk and frustration for adviser firms trying to do the right thing.

When “doing the right thing” becomes difficult

We’ve seen situations where providers:

• Refuse to accept documents containing personal information in a password-protected format
• Actively request that documents are sent as basic, unsecure email attachments
• And even some instances of providers suggesting that documents should be sent by post instead!

Let’s pause on that for a moment.

Sending sensitive client information by post… in 2026… as a workaround for digital security concerns?

Aside from the obvious GDPR implications, the operational impact is significant:

• Delays in processing
• Slower client outcomes
• Increased admin time
• Higher costs

All because secure digital processes aren’t consistently in place.

Not all providers

To be clear, there are providers who take GDPR seriously.

They have robust encryption and secure upload systems in place, and working with them is seamless.

However, it’s the inconsistency across the wider provider landscape that creates the real problem.

The accountability gap

Here’s the uncomfortable question:

Why aren’t providers being held more accountable?

Advisers operate in a highly regulated environment where GDPR compliance is non-negotiable.

Yet when providers:

• Reject secure methods of communication
• Fail to encrypt emails
• Push advisers towards less secure alternatives

..there appears to be little consequence.

A wider issue for the profession

If GDPR is to be taken seriously across the industry, it needs to be applied consistently, not selectively.

Advisers have invested significant time, effort, and resource into protecting their clients and operating within GDPR regulations.

So it’s a fair question to ask:

How can adviser firms be expected to uphold these standards, when large provider firms are not consistently held to the same level of accountability?