GDPR question

purplepixi

I bank with Mettle, have been with them for the last 12 months.  Today I've received notification that they are reviewing my account. They've picked out 4 transactions that they would like more information about. They are incoming payments from other people that have been invoiced. All businesses. They haven't specified what information they would like. But I've been told if I don't provide more information by 20th May they will restrict my account. 

They are invoices paid for services provided. If I was to send over copies of the invoices would I need to blank out the contact details or is it ok to leave them on as they are all businesses no private individuals?

MorningcoffeeIV

Individuals within businesses still have the same rights as other individuals.

What does your privacy policy state re how and when you share data? You should have a section within there re sharing data with other organisations or for legal or regulatory purposes.

If you're not sure - or your privacy policy isn't up to scratch - remove the names, leaving the business details. 

Grumpy_chap

Is the OP's bank account a personal or business account?

Pennywise

As long as there are no personal names or other personal identification on the invoices, just the customer's company name and registered office address, then there's no GDPR breach as that company name and reg office address are already in the public domain via Companies House.