GDPR and KYC: how data protection applies to identity checks on EU residents

What it is

The General Data Protection Regulation, Regulation (EU) 2016/679, is the EU's main data protection law. KYC sits at an awkward point in it. AML law requires firms to collect identity documents, beneficial ownership details and screening results, and the GDPR requires that collection to be lawful, limited, secure and time-bound.

The GDPR reaches beyond the EU. Under Article 3(2) it applies to a controller outside the EU that offers goods or services to people in the EU, or monitors their behaviour there. A non-EU firm in that position must usually appoint a representative in the EU (Art 27).

From 10 July 2027 the EU AML Regulation adds specific rules for KYC data: when special category and criminal offence data may be processed (Art 76) and how long records are kept (Art 77). Separately, the Commission proposed changes to the GDPR in its Digital Omnibus in November 2025. In October 2026 member states agreed their position, keeping the current definition of personal data. Negotiations with the Parliament have not finished.

What you have to do

Each duty is matched to the kind of work where it bites. How you meet it is for your own privacy and AML programs to decide.

1. Pick and record a lawful basis

   For CDD required by EU or member state law, Article 6(1)(c) applies. A firm whose AML duty comes from non-EU law needs another basis, such as legitimate interests under Article 6(1)(f), and should record why.

   Intake
2. Tell clients what you collect and why

   Explain at collection what data you process for AML checks. The AMLR makes this an express condition for processing special category data (Art 76(2)(a)).

   Intake
3. Treat biometric checks as special category data

   A selfie match used to uniquely identify someone needs an Article 9(2) exception, such as explicit consent or substantial public interest based on law. From July 2027, AMLR Article 76 permits processing that is strictly necessary to prevent money laundering, with safeguards.

   Verify
4. Handle criminal offence data from screening carefully

   Article 10 allows criminal offence data only under official authority or where EU or member state law authorises it. AMLR Article 76(3) adds that the data must relate to money laundering, predicate offences or terrorist financing, and that procedures must tell allegations apart from convictions.

   Screen
5. Keep records for the set period, then delete

   Apply storage limitation (Art 5(1)(e)). Under the AMLR, keep CDD records for five years after the relationship ends or the transaction or refusal, then delete them unless other law requires longer (Art 77(3)).

   Records policy
6. Put a safeguard on international transfers

   Data can flow freely only to countries with an adequacy decision. For others, including Australia, use an Article 46 safeguard such as standard contractual clauses.

   Contract and vendor review

What happens when

1. 25 May 2018In force

   GDPR applies Source

2. Nov 2025Proposed

   Commission proposes GDPR amendments in the Digital Omnibus Source

   Confirmed by secondary sources; the regulator has not published the exact date.

3. Oct 2026Proposed

   Member states agree their negotiating position, keeping the current personal data definition Source

   Confirmed by secondary sources; the regulator has not published the exact date.

4. 10 Jul 2027Commencing

   AMLR applies, including Art 76 (special category and criminal data) and Art 77 (five-year retention) Source

5. Not yet setProposed

   Digital Omnibus GDPR amendments adopted and applied Source

   Not yet confirmed. We will update this when the date is set.

Questions people ask

Where StackGo fits

StackGo is compliance middleware. IdentityCheck runs the identity, screening and intake steps where most KYC personal data is created. The lawful basis, notices, retention policy and transfer safeguards remain the firm's decisions as controller.

See how the workflows run Book a demo