Written by: Agata Wojtas, Chief Commercial Officer, Digital Colliers
Coupang just booked a $409M data-breach penalty. That single line item pushed their Q2 operating loss to $556M. If you run risk or data at a mid-market bank, sit with that number for a second. It's larger than most mid-market compliance budgets for the entire year.
The question isn't whether your bank could survive a fine of that size. Most couldn't. The question is what regulators will ask you the morning after an incident, and whether you can answer in hours instead of weeks.
The question you can't answer at 2am
Every post-breach conversation starts the same way. Which customer records were touched. Which systems held copies. Who had access. Which downstream reports, models, and third parties consumed that data. In the EU, GDPR carries fines up to €20M or 4% of global turnover, and DORA has been in force since January 2025 with its own operational-resilience expectations layered on top.
Most mid-market banks I look at cannot answer those questions from a single source of truth. The knowledge is scattered across a data warehouse team, a handful of application owners, some Confluence pages last updated in 2022, and two or three senior engineers who happen to remember. That's the exposure. Not the breach itself. The inability to describe what happened.
The minimum lineage graph
You don't need a full enterprise data catalog to survive the first 72 hours of a regulator conversation. You need a lineage graph that answers five questions on demand:
- For any customer PII field, which source system is authoritative.
- Every downstream store that field lands in, including replicas, backups, analytics copies, and vendor exports.
- Every model, report, or automated decision that consumes it (automated credit scoring already carries GDPR exposure under the SCHUFA ECJ ruling from December 2023, so this matters more than it used to).
- Every human or service account with read access at each hop.
- The retention clock on each copy.
That's it. Five columns. Not a two-year catalog rollout. A living document that a regulator, an auditor, or your own incident commander can read on a Sunday night.
How to build it without a catalog project
The teams getting this right in 2026 tend to skip the big-bang tooling decision. They start with a scoped inventory and grow it. The pattern looks something like this:
- Pick the ten to fifteen data elements that carry the most regulatory weight. Names, national IDs, account balances, transaction histories, KYC documents. Not everything. The stuff that ends up in a breach notification.
- Trace those elements by hand, in one week, with two engineers and one data owner per system. Write the lineage down in a plain repo. Markdown is fine. Diagrams optional.
- Attach the access lists at each hop. Pull them from IAM, not from memory.
- Automate the parts that decay. Schema changes, new downstream consumers, retention overruns. A nightly job that diffs the graph against reality beats a quarterly manual review.
- Review the graph every time you ship a new model or vendor integration. Especially any automated decisioning, given where the AI Act is heading. High-risk obligations apply from 2 December 2027, with transparency duties from 2 August 2026, and fines up to €15M or 3% of global turnover for the worst violations.
None of this needs a six-figure platform. It needs one senior engineer with authority to ask questions across silos, and a mandate from the CRO to keep the graph honest.
The cost of not having it
Here's the arithmetic that keeps me up. A mid-market bank running AML on legacy rules is already burning capacity on false positives at the industry-typical 85 to 95% rate. Add a breach. Add a regulator asking for lineage you can't produce. Add GDPR at 4% of turnover, DORA remediation orders, and an AI Act inquiry into any model touching the affected data.
The Coupang number stops looking like an outlier. It starts looking like the ceiling of what any regulator can reach for when the answer to "where did this data go" is a shrug.
Build the graph before you need it. It's a two-engineer project, not a platform decision. And it's the cheapest insurance policy on your desk this year.