Protecting client data while supporting daily work

Private banking brings several requirements together: clients expect confidentiality, advisers need to communicate, operations must maintain services and security teams need to investigate incidents.

My Swiss private bank engagement brought those concerns into an Azure and Microsoft 365 migration. The design problem was to protect information while preserving accountable ways to do necessary work.

Map information and the task together

Before choosing a data loss prevention (DLP) action, identify what information needs to move, who may receive it and which channel is appropriate.

Use that context to choose between logging, review, quarantine and blocking. A legitimate transfer and an unauthorised export may use the same application; the policy needs to distinguish the circumstances.

During migration, document coverage before and after each stage. Email, browser uploads, printing and endpoint activity have different control points. Keep an existing protection until its replacement covers the relevant use case and has been checked.

Protect investigation access

Alerts and investigation records may contain the information the controls are intended to protect. Separate platform administration from permission to inspect client data.

Define who can review evidence, what they need to see and how long it should be retained. Assess masking or pseudonymisation against the actual investigation workflow.

For privileged access, define the task, role, scope, duration and approval path. Recovery and urgent support need equally clear procedures.

Plan for legitimate work being blocked

Decide how a user reports a problem, who reviews it and how a policy correction is tested and approved. Record the decision so future investigations have context.

This gives business and security teams a shared way to evaluate the trade-off: maintain protection, limit unnecessary access and let legitimate work proceed through a controlled process.