NACFB & FLA Joint Statement – GDPR and the broking process


The National Association of Commercial Finance Brokers (NACFB) has issued a joint statement with The Finance & Leasing Association (FLA) outlining a unified interpretation of how the broking process is impacted by the General Data Protection Regulations (GDPR).

The statement, from two of the largest and most established trade bodies operating in commercial finance sector, confirms a consistent and allied interpretation of the GDPR, specifically on the implementation and use of Privacy Notices.

The joint statement has been arrived at after consulting members, lenders and the regulator and forms part of ongoing efforts by both Associations to safeguard all Member’s interests.


GDPR Statement for Funders and Brokers

This statement has been prepared as guidance for brokers to consider when they act as a finance intermediary. This statement does not constitute legal advice and is intended to inform rather than replace any implementation plans you have in place based on your interpretation of the regulation. If you require clarification in relation to any matters referred to in this document we recommend you seek independent legal advice.

The General Data Protection Regulation (GDPR) came into effect on 25 May 2018. Firms which are already complying properly with the current data protection legislation will be largely compliant with the new Regulation. The GDPR does, however, place greater emphasis on the documentation that controllers must keep to demonstrate their accountability.


Privacy notices

While the GDPR does permit privacy notices to refer to ‘categories’ of recipients of the individual’s information, rather than necessarily named recipients, this possibility has to be considered alongside the Regulation’s overall requirement that information be handled fairly and transparently. This is a high bar.

Consistent with this, the ICO’s view is therefore that the most practical solution is for the intermediary’s privacy notice to summarise the key points that appear in finance providers’ privacy notice and explain why the individual’s information is being passed to finance providers, with individuals then being directed to finance providers’ websites where their own privacy notices can be read.

The inclusion of links to finance providers’ information is however not mandatory and it is for firms to consider the most appropriate approach for their organisations and customers.

Please note that, the intermediary’s privacy notice should be provided to the individual at the time you obtain their data from them.

It should be remembered that some individuals may not have access to, or be able to use, digital sources. Intermediaries should therefore ensure that such individuals are able to access the privacy information by alternative means, for example by telephone or verbally: see the ICO’s guidance on how to deliver privacy notices for further information on this. It should also be remembered that, if the individual’s data is going to be handled differently in some way, then this should be clearly explained to them. In some cases, lenders may ask intermediaries to have copies of certain information available, should a customer need a paper copy. One example is the Credit Reference Agency Information Notice (CRAIN). Lenders will let intermediaries know where this is the case.

NACFB expands into new office

The NACFB headquarters is on the move after six years at Hamilton House. On Tuesday 26th June we are moving to:

33 Eastcheap, London, EC3M 1DT


Not a dramatic move geographically, but an important one nonetheless. I am keen to outline to you both why we have made this decision and how this will benefit the Association.

Hamilton House is a serviced office located in a building of some external charm on the Embankment, but once inside the premises do not stand up well to scrutiny. They are not fit for our purpose and certainly do not contribute to our plans of running an efficient Member Association with the best people in a pleasant and safe environment.

In addition, a planned sale of the building by the current landlords accentuated the potential operational risk of having only two months security of tenure. So, it was time to look for somewhere new.

At 33 Eastcheap we have secured office space that enables the whole team to work together in one room with some capacity to grow. We have a separate meeting room where we can run events rather than hiring external facilities. The building has been newly refurbished and so it is a modern environment demonstrating our passion to invest in our people. We have a 10-year lease, so we have the security of knowing we can focus on our objectives without worrying about a roof over our head.

Bank, Monument, Fenchurch Street, Tower Gateway, Tower Hill, Liverpool Street and London Bridge stations are also within a short walk away from the Eastcheap offices.

Our current telephone number will remain the same and the team will endeavour to deal with any Membership enquiries seamlessly throughout the move.

Please do bear with us on the day of the move because there will be a period of time when we will not have access to emails or phones. We shall ensure that a suitable out of office message is delivered on the day.

Thank you for your accommodation and support.

Graham Toy