Data protection is the body of law and practice that governs how organisations collect, use, share, store and secure personal information. In Europe and much of the world it is the legal term for the field, while in the United States the same ground is more often called privacy. The underlying rights and principles are explained in full in the Data Privacy entry.
The two words lean in slightly different directions. Privacy asks whether a use of personal data is fair and permitted at all; protection also covers the safeguards that keep it safe, such as access controls and encryption. The best-known data protection law is the EU's General Data Protection Regulation (GDPR), which has applied since May 2018 and allows fines of up to €20 million or 4% of a company's worldwide annual turnover, whichever is higher.
For banks and payment firms, data protection overlaps with security and with duties to report a data breach to regulators and affected customers.