Open Finance – Bank Customer Data Security under the LGPD Perspective

Alexander Mello de Oliveira; Marcelo Alves Teodoro

DOI: 10.22167/2675-6528-202602606

Article derived from a Course Conclusion Work (TCC), with content based on the student’s original work and adapted to the editorial format of the E&S Magazine with the support of the ResumeAI tool, an artificial intelligence solution developed by Instituto Pecege for textual synthesis and organization.

Summary

The advancement of Open Finance in Brazil has brought about significant changes in the financial sector, expanding the sharing of banking data and intensifying information security challenges. In this context, the General Data Protection Law (LGPD) established fundamental guidelines for the adequate treatment of information. The study analyzed the perception of employees from a public financial institution regarding the security of customer banking data in Open Finance, from the perspective of the LGPD. A descriptive research with a mixed approach was conducted, combining bibliographic and documentary review with the application of a structured questionnaire to 124 employees of the institution. Data analysis, using descriptive statistics and cross-tabulation, identified perception patterns regarding the effectiveness of security measures, the level of knowledge of the legislation, and the adequacy of training. The results showed that, although participants demonstrated confidence in internal processes and institutional compliance, there was a relevant gap in formal training on LGPD and Open Finance. It was highlighted that, as it is a non-probabilistic sample from a single institution, the findings are not generalizable. It was concluded that strengthening corporate training and education actions, through periodic plans, incident simulations, and the use of performance indicators, is essential to mitigate risks and consolidate a secure environment in the open financial system.

Keywords: Financial institutions; Data legislation; Data protection; Information security; Open financial system.

1. Introduction

Digital transformation has promoted structural changes in the financial sector, driving new business models and increasing competitiveness among institutions. In this context, the implementation of Open Finance in Brazil stands out, an ecosystem that allows the structured sharing of customer financial data among authorized institutions, with express consent, aiming to expand access to more personalized and competitive products and services (Leite and Camargo, 2022).

Open Finance emerges as an evolution of Open Banking, significantly expanding the scope of shareable data beyond traditional banking products. According to the Central Bank of Brazil (BCB, 2025), this model incorporates information related to investments, insurance, pensions, and other financial services, with the aim of fostering innovation, increasing the efficiency of the national financial system, and strengthening the customer’s protagonism over their own data. This expansion, however, intensifies the circulation of information, raising the risks associated with information security and the protection of personal data.

In this scenario, the General Law for the Protection of Personal Data (LGPD), established by Law No. 13.709/2018, assumes a central role by setting guidelines for the adequate processing of personal data, ensuring the fundamental rights of freedom, privacy, and informational self-determination. It is important to note that, from the strict perspective of Article 5 of the LGPD, banking and financial data are not classified as ‘sensitive data’, but rather as personal data protected by the strict legal duty of banking secrecy and by standards such as ISO 27001. The LGPD imposes on financial institutions the responsibility to adopt technical and administrative measures capable of ensuring the security, confidentiality, and integrity of data shared within the scope of Open Finance, mitigating risks of leaks, unauthorized access, and improper use of information (Pinheiro, 2023).

Although the Brazilian regulatory framework is considered robust, the effectiveness of data protection in Open Finance does not depend exclusively on technological solutions or formal compliance with legal norms. Studies indicate that human errors, combined with a lack of awareness and training among professionals involved in data processing, can represent significant vulnerabilities, even in organizations with advanced technological systems (Branco and Teffe, 2022). Thus, the human factor emerges as a critical element for consolidating a secure and trustworthy environment in the open financial system.

Given this context, it becomes relevant to understand how financial institution employees themselves perceive the security of banking data in Open Finance, the level of compliance with the General Data Protection Law (LGPD), and the adequacy of the training offered. The internal perception of these professionals, who deal directly with information, reflects their institutional confidence and their daily culture, influencing the effectiveness of security practices and institutional trust in the open financial system. This study contributes to deepening discussions on data governance, information security, and regulatory compliance in the context of Open Finance, in addition to supporting actions to improve internal policies, training programs, and risk mitigation strategies, strengthening customer confidence and the sustainability of the open financial system in Brazil.

In this way, the present work seeks to analyze the perception of employees of a public financial institution regarding the security of banking data in Open Finance, considering the principles and guidelines of the General Data Protection Law [LGPD].

2. Material and Methods

The research conducted was characterized as descriptive, seeking to analyze and record the perceptions of employees of a public financial institution regarding the security of banking data in the context of Open Finance, from the perspective of the General Data Protection Law [LGPD]. This type of study was employed to observe and describe phenomena without direct interference from the researcher (Lakatos and Marconi, 2003), aligning with the objective of understanding the professionals’ vision.

The methodological approach adopted was mixed, combining qualitative and quantitative elements for a comprehensive understanding of the phenomenon. The qualitative stage involved a bibliographic and documentary research, used to theoretically ground the study based on academic publications and Central Bank regulations on Open Finance and LGPD. The quantitative stage, in turn, allowed for the measurement of participants’ perceptions and attitudes (Creswell, 2014).

The research design consisted of a field survey, a method that enabled the direct collection of information from individuals whose perceptions were the focus of the study (Lakatos and Marconi, 2003). Primary data were collected directly from the employees of the financial institution under study, while secondary data were obtained through a review of literature and regulatory documents.

The unit of analysis was composed of employees from a Brazilian public financial institution. The sample was defined by non-probabilistic convenience sampling, selected based on the ease of access and availability of respondents (Malhotra, 2012). This strategy was chosen to reach professionals directly involved in the treatment of banking data.

The invitation to participate was sent to approximately 800 employees of the public financial institution through internal communication groups. At the end of the collection period, between May 26 and June 9, 2025, 124 valid responses were obtained. All participants agreed to the Informed Consent Agreement [ICA] and completed the questionnaire in full.

The data collection instrument was a structured questionnaire, developed on the Google Forms platform and made available online (Oliveira, 2025). The questionnaire contained 19 questions, distributed into four main sections: Free and Informed Consent Term [TCLE], Perception of data security and treatment, General perception of the General Data Protection Law [LGPD] and security, and Additional comments.

Participation in the research was voluntary and anonymous, with acceptance of the Free and Informed Consent Form [TCLE] being mandatory to proceed with completion. The TCLE guaranteed the confidentiality of the responses, ensuring the protection of the information provided by the participants.

For the analysis of quantitative data, descriptive statistics were used, which allowed summarizing the information through absolute and relative frequencies (Barbetta, 2010). This approach made it possible to identify perception patterns, knowledge levels, and assessments regarding security and compliance with the General Data Protection Law [LGPD].

The open-ended responses, collected in the additional comments section of the questionnaire, were analyzed qualitatively. This analysis complemented the interpretation of quantitative data, allowing for the identification of relevant perceptions and nuances that were not captured by the closed-ended questions, thus enriching the understanding of the studied context.

Regarding ethical considerations, the questionnaire included the Consent Agreement [TCLE], ensuring the voluntariness, anonymity, and confidentiality of the responses. As the research did not involve the collection of sensitive participant data and was based solely on professional perceptions, there was no need for submission to the Research Ethics Committee (CEP), according to the institutional guidelines of PECEGE.

3. Results and Discussion

The research results revealed a complex panorama regarding the perception of employees of a public financial institution about the security of customer banking data in the context of Open Finance, from the perspective of the General Data Protection Law (LGPD). In general, a coexistence was observed between high institutional trust in security processes and the identification of significant fragilities, especially concerning the formal training and awareness of collaborators. These findings are crucial for understanding the dynamics of data protection in an increasingly interconnected and regulated financial environment.

The initial data analysis allowed us to profile the participants, highlighting the relevance of the sample for the study. It was found that the majority of respondents, precisely 92.7%, work directly in customer service, whether through physical or digital channels. This characteristic is fundamental, as these are the professionals who maintain frequent contact with customer information, playing a central role in the treatment, sharing, and protection of banking data, as highlighted in the study’s introduction.

Additionally, the sample demonstrated a high level of professional experience, with 95.1% of participants having more than five years of experience in the financial institution. Such longevity suggests a deep familiarity with the organization’s internal processes, operational standards, and information security policies. This practical experience lends greater solidity to the perceptions collected, indicating that they are based on real experiences and not just superficial theoretical knowledge on the subject.

Another relevant piece of data from the profile is that 78% of respondents stated they are directly involved in the processing of banking data related to Open Finance. This percentage reinforces the relevance of the sample, as the responses reflect the perspective of professionals who actively participate in the routines associated with data sharing in the open financial system, making their perceptions directly applicable to the scope of the research.

Perception of the importance and effectiveness of institutional security

The financial institution’s employees demonstrated a predominantly positive perception regarding the organization’s emphasis on customer data security in Open Finance. The data revealed that 79.7% of participants classified the level of importance as high or very high. This finding suggests that information security is recognized internally as a relevant institutional value, aligned with the regulatory requirements of the financial sector, as established by the Central Bank of Brazil (BCB, 2025).

This positive perception is an indication that the institution seeks to build an organizational culture oriented towards data protection, even if this culture is not yet fully consolidated in all its aspects, especially in formal training. Internal recognition of security as a priority is a fundamental step towards regulatory compliance and maintaining customer confidence, an essential pillar for the success of Open Finance, as pointed out by Dominguez and Paravela (2021).

Regarding the evaluation of the effectiveness of the security measures implemented by the institution, the results were also predominantly favorable. It was found that 72.4% of respondents considered these measures effective or very effective in protecting data shared in Open Finance. This positive assessment indicates that the technical and procedural mechanisms adopted by the institution are perceived by employees as adequate for mitigating the risks associated with data sharing.

This perception of effectiveness contributes to the construction of an organizational environment marked by confidence in internal processes and regulatory compliance. Employee confidence in internal systems and procedures is a factor that can positively influence the adoption and operation of Open Finance, reinforcing the idea that information security is a fundamental pillar for the functioning of the open financial system (Gomes, 2022).

Knowledge and training in LGPD and Open Finance

Despite the positive perception regarding the importance of institutional security, the data revealed a significant gap in the formal training of employees on the General Data Protection Law (LGPD) and Open Finance. Only 13.8% of participants stated they had received complete and adequate training on these topics, which contrasts with the strategic relevance of data protection in the financial sector.

In contrast, a considerable portion of respondents, 47.2%, reported having received only basic training, while 36.6% stated they had not received any specific training on the subject. This result highlights a discrepancy between the perceived robustness of security systems and the level of formal preparedness of employees to deal with the legal and operational requirements related to the protection of personal data, a critical aspect for the effectiveness of the LGPD (Pinheiro, 2023).

To deepen the understanding of this dynamic, a cross-analysis of the data was performed. It was observed that among employees who received complete training, 82.4% reported having in-depth knowledge and presented a more critical view of practical safety routines. In contrast, more than 85% of those who received only basic training or no training demonstrated purely passive confidence in the institution, with a limited understanding of operational risks.

This difference in perception and knowledge level reinforces the idea that formal training is a differentiator for the internalization of data protection culture. The participants’ open comments corroborated this perception, with one employee highlighting the need for “more training.” Another comment pointed to the existence of “informal practices in institutional daily life,” such as the “informal disclosure of confidential data to third parties,” evidencing the fragility in the human aspect of information security, a point raised by Branco and Teffe (2022).

Main challenges for data security

When asked about the biggest challenges in ensuring customer data security within the scope of Open Finance, participants pointed to sophisticated cyber threats as the main concern, mentioned by 72.4% of respondents. This result reflects the perception that external attacks represent a constant and growing risk to the financial sector, requiring continuous investments in technology and robust defense strategies, as discussed by Gomes (2022).

Beyond technological threats, human factors were also widely cited as significant challenges. Lack of employee awareness and lack of customer awareness were mentioned by 27.6% of participants, respectively. This data indicates that inadequate behaviors, misinformation, or lack of knowledge of good security practices are perceived as relevant vulnerabilities, even in organizations with advanced technological systems.

Other factors perceived as challenges include the technological complexity of the systems, cited by 18% of respondents, and the difficulty in ensuring full compliance with the General Data Protection Law (LGPD), mentioned by 15%. These results suggest that the information security challenges in Open Finance are multidimensional, involving technological, organizational, and behavioral aspects, and are not restricted solely to technical solutions, but require an integrated approach.

The mention of the difficulty of compliance with LGPD, although less frequently, is an important point, as the legislation imposes clear responsibilities on financial institutions. The complexity of the regulatory environment and the need for continuous adaptation of internal processes can generate challenges for maintaining compliance, especially in a rapidly evolving scenario like Open Finance.

Institutional transparency and confidence in Open Finance

The research also investigated employees’ perception of the institution’s transparency and their own confidence in Open Finance. The majority of employees, 62.6%, believe that the financial institution is transparent with clients regarding the use of their data in Open Finance. This perception of transparency is a crucial factor for building trust in the open financial system and can positively influence customer adherence to data sharing, as pointed out by Sosa (2021).

This institutional confidence is reflected in the willingness of employees themselves to use Open Finance. A significant portion, 97.6% of participants, stated that they would use or consent to the sharing of their own banking data through Open Finance, either without reservations or with some caution. This data is a strong indicator of a significant level of confidence in the system and the security mechanisms adopted by the institution, validating the importance of institutional reputation.

Additionally, 71.5% of respondents stated they felt safe or very safe using Open Finance, based on their internal knowledge of the institution’s security processes. Only 11.4% reported feeling unsafe or very unsafe, which reinforces the general perception of trust in institutional data protection mechanisms. However, this confidence appears to be more associated with the organization’s solid image than with in-depth knowledge of the LGPD and its practical implications.

This dissociation between confidence and formal knowledge represents a latent vulnerability. Although employees feel confident using Open Finance, the lack of adequate training can compromise their ability to identify risks, prevent incidents, and respond effectively to data breach situations. This scenario reinforces the need for training strategies that go beyond one-off training sessions and promote an organizational culture oriented towards data protection, a crucial aspect for data governance (Ramos et al., 2025).

The results obtained provide an in-depth understanding of the perception of employees of a public financial institution regarding the security of banking data in the context of Open Finance, from the perspective of the General Data Protection Law (LGPD). It was found that, although participants demonstrate considerable confidence in internal processes and institutional compliance, there is a relevant gap in formal training on LGPD and Open Finance, which may compromise the effectiveness of security measures.

The majority perception that the institution attributes a high degree of importance to information security and adopts effective protection measures is aligned with the regulatory guidelines established by the Central Bank of Brazil (BCB) for Open Finance. This perception contributes to the construction of an organizational environment marked by trust in internal processes and regulatory compliance, a fundamental aspect for the adherence and success of the open financial system.

However, the paradox between this institutional trust and the data regarding employee empowerment is notable. Only a small portion of participants reported having received complete and adequate training on LGPD and Open Finance, while the majority stated they had received only basic training or none at all. This finding corroborates the literature by indicating that the effectiveness of data protection depends not exclusively on technological solutions or formal compliance with legal norms, but also on the internalization of information security principles by the individuals who operate the systems (Branco and Teffe, 2022).

The challenges pointed out by the participants, such as the predominance of sophisticated cyber threats and the expressive mention of the lack of awareness among employees and clients, reinforce the interpretation that the human factor remains one of the main vectors of vulnerability. The perception that informal practices and inadequate behaviors still occur in institutional daily life, as indicated in the open comments, suggests that the data protection culture is not fully consolidated, requiring continuous attention.

The high willingness of employees to use Open Finance to share their own banking data, although positive, seems to be more associated with the institutional image and the perception of system robustness than with the effective understanding of data protection legislation and its practical implications. This dissociation between trust and formal knowledge reinforces the need for more comprehensive and continuous training strategies that promote an organizational culture oriented towards data protection.

In summary, the research results indicate that strengthening data governance in the context of Open Finance requires an integrated approach, combining technological investments, regulatory compliance, and continuous human capital development. Expanding specific training programs on LGPD, along with practical awareness actions, effective internal communication, and security incident simulations, can help reduce operational vulnerabilities, align individual behaviors with legal requirements, and consolidate a robust organizational data protection culture, directly addressing the study’s central objective.

4. Conclusion

This study analyzed the perception of employees of a public financial institution regarding the security of banking data in Open Finance, from the perspective of the General Data Protection Law [LGPD]. It was found that participants demonstrated high confidence in the security measures implemented by the institution and recognized the importance attributed to the protection of customer data. This positive perception suggested that the organization has processes and controls aligned with the regulatory guidelines of the Central Bank of Brazil and the principles of the LGPD. However, a relevant gap was observed in formal training on LGPD and Open Finance, with most employees reporting having received only basic or no training. This dissociation between institutional confidence and in-depth knowledge of the legislation and its practical implications represents a latent vulnerability. The main perceived challenges included sophisticated cyber threats and, significantly, a lack of awareness among both employees and customers, highlighting the human factor as a critical risk vector.

The main contribution of this work lies in the in-depth understanding that the effectiveness of data protection in Open Finance transcends technological solutions, requiring an integrated approach that combines investments in technology, regulatory compliance, and the continuous development of human capital. It is suggested that the strengthening of data governance be achieved through the expansion of specific training programs on LGPD, practical awareness actions, effective internal communication, and security incident simulations. Such measures can mitigate operational vulnerabilities, align individual behaviors with legal requirements, and consolidate a robust organizational data protection culture, strengthening customer trust and the sustainability of the open financial system in Brazil. As a limitation, it is highlighted that the non-probabilistic sample, restricted to a single institution, prevents the generalization of the results. For future studies, it is recommended to expand the sample to other financial institutions and conduct comparative analyses on different levels of maturity in information security and LGPD compliance in the context of Open Finance.

Bibliographic References

Banco Central do Brasil [BCB]. 2025. Open Finance. Disponível em: https://www.bcb.gov.br/estabilidadefinanceira/openfinance. Acesso em: 21 mar. 2025.

Barbetta, P.A. 2010. Estatística Aplicada às Ciências Sociais. 7. ed. Editora da UFSC, Florianópolis, SC, Brasil.

Branco, S.; Teffe, C. 2022. Proteção de Dados e Tecnologia: Estudos da Pós Graduação em Direito Digital. 1. ed. ITS Rio, Rio de Janeiro, RJ, Brasil.

Creswell, J.W. 2014. Research Design: Qualitative, Quantitative, and Mixed Methods Approaches. 4. ed. Sage Publications, Thousand Oaks, CA, USA.

Dominguez, O.J.; Paravela, C.T.L. 2021. Open banking: a implementação do sistema financeiro aberto no Brasil na perspectiva do consumidor. Revista da Procuradoria do Banco Central 15(2): 181-193.

Gomes, L. J. 2022. Open Finance e LGPD: erros que a sua fintech não pode cometer ao compartilhar dados. JusBrasil. Disponível em: https://www.jusbrasil.com.br/artigos/open-finance-lgpd-erros-que-sua-fintech-nao-pode-cometer-ao-compartilhar-dados/1464757014. Acesso em: 22 mar. 2025.

Lakatos, E.M.; Marconi, M.A. 2003. Fundamentos de Metodologia Científica. 5. ed. Atlas, São Paulo, SP, Brasil.

Leite, L.; Camargo, M. 2022. Open Banking: Inovação Aberta no Sistema Financeiro. 1. ed. Expressa Saraiva, São Paulo, SP, Brasil.

Malhotra, N.K. 2012. Pesquisa de Marketing: Uma orientação aplicada. 6ed. Bookman, Porto Alegre, RS, Brasil.

Oliveira, A.M. 2025. Questionário: percepção sobre Open Finance, segurança de dados e LGPD. Disponível em: <https://docs.google.com/forms/u/0/d/1vwZJp6L52au67feILKPjmQYDJULcMcFzi1pS7z4HLSM/printallresponses.>. Acesso em: 10 jun. 2025.

Pinheiro, P.P. 2023. Proteção de Dados Pessoais: Comentários a Lei N.13.709/2018. 4. ed. Saraiva, São Paulo, SP, Brasil.

Ramos, G.G.R.; Silva, C.G.; Santos, Q.E.; Jeunon, A.E.; Silva, M.H.; Nascimento, H.P. 2025. Aplicação do blockchain com a utilização do open finance na gestão da identidade digital. Revista Observatorio de la Economia Latino Americana 23(3): 1-29.

Sosa, Eduardo. 2021. O uso da inteligência competitiva no processo de inovação do open banking: um estudo em instituições financeiras brasileiras. 1. ed. Dialetica, São Paulo, SP, Brasil.

Article originating from a Course Conclusion Work

To learn more about the course, click here and access the MBX Academy platform