The Hidden Cost of Holding Customer Data: Why CFOs Should Rethink Their Risk Approach
What’s the real cost of holding customer data?
Most organisations rightly treat data as an asset; a fuel for growth, personalisation, and service delivery. But how often do boards stop to ask: what if this “asset” is also the single biggest liability on our books? What if the customer information we’re holding today is the very thing that could bankrupt us tomorrow?
Because when you hold sensitive data, you also hold the financial liability if it’s compromised. And regulators don’t care whether the breach came from your tech, your people, or your third-party provider. If the data is exposed, everyone pays.
But what if there was a way to significantly reduce this liability, without impacting your service delivery?
Data is financial risk capital
Regulations have tightened up on data protection rules and litigation. Under GDPR, fines can reach 4% of global revenue per breach. In 2021, Amazon was fined €886 million for GDPR violations. DORA and NIS2 add strict accountability for boards and executives, while CJIS enforces mandatory encryption key ownership for law enforcement agencies.
The costs don’t end with fines. The average total cost of ransomware recovery for UK organisations rose to $2.58 million in 2025. Add in litigation, lost contracts, and reputational fallout, and the real number can be far higher.
For CFOs, each piece of sensitive data represents potential financial exposure that could impact the organisation if it’s compromised
The hidden reserves draining profitability
Behind the scenes, regulators expect that if you’re holding sensitive data, you’re financially capable of covering the fallout of a breach. That means CFOs need to plan for the potential financial impact of data breaches, including fines, litigation, and reputational costs. Organisations with larger data holdings may face proportionally higher exposure, which can strain profitability if not carefully managed
Shared liability: you can’t contract your way out
One of the most dangerous misconceptions in the boardroom is that liability can be outsourced. It can’t.
GDPR, DORA, and NIS2 make it clear: responsibility is shared across data processors. If your service provider, cloud partner, or contractor mishandles data, you’re still accountable. Regulators won’t stop at the weakest link; they’ll fine everyone in the chain.
This means one breach can multiply into several regulatory actions. And no contract clause will save you.
Why cybersecurity spending doesn’t fix the problem
Boards often assume that spending more on cybersecurity reduces financial liability. But that isn’t how regulators see it.
Attackers aren’t breaking in; they’re logging in with stolen credentials. Even the most sophisticated firewalls and monitoring can’t prevent exposure once access is gained. When data is compromised, regulators don’t care how many layers of defence you bought. They only care that you held it, and you lost it.
Cybersecurity tools can slow attackers down. They do nothing to shrink the liability of holding data. If you can see it, you can lose it. And if you can lose it, you’re financially exposed.
The alternative: eliminate liability at the source
The radical but logical answer is simple: don’t hold what you don’t need.
For decades, companies assumed that to deliver a service, they had to see and store customer data. That assumption is what created today’s liability trap. But technology has moved on. Data can now be protected in transit in a way that keeps it functional for the business while remaining inaccessible to the business itself.
If your systems can function without ever seeing or accessing sensitive data, you remove liability entirely. You can process, transmit, and deliver outcomes, but without the exposure that triggers regulatory fines.
No access means no exposure. And no exposure means no reserve required.
This shifts the equation for CFOs. Instead of carrying risk reserves that drain profitability, you can redesign operations so the liability is reduced in the first place.
Why the time to act is now
Regulatory penalties aren’t slowing down; they’re escalating. GDPR fines now run into the hundreds of millions. DORA and NIS2 explicitly make boards and executives personally accountable. And quantum computing threatens to break today’s protection methods, exposing encrypted data already stored today.
And here’s the part too many CFOs overlook: liability is shared. Under GDPR and related regulations, you cannot contract your way out of responsibility. If your third-party provider mishandles data, you’re still on the hook. One breach can mean multiple fines across the same data chain.
When you can access sensitive data, risk reserves balloon, margins erode, and profitability becomes hostage to regulators.
CFOs can’t afford to treat this as tomorrow’s problem. The question is whether boards act now to eliminate liability at the source or wait until the regulator, the attacker, or the market forces the issue.
Because the strongest companies in the next decade won’t be those with the biggest reserves. They’ll be the ones with the least to lose.