- 18 Nov 2026 UK Have your directors and PSCs verified with Companies House?
- 1 Dec 2026 AU Will your onboarding accept private-sector Digital IDs?
- 10 Dec 2026 AU Does your privacy policy explain your automated KYC decisions?
- End 2026 EU Is your ID verification ready for EUDI Wallets?
- 1 Jan 2027 US Can your age checks keep up state by state?
- 1 Apr 2027 JP Is your eKYC ready for the IC-chip mandate?
- 10 Jul 2027 EU Is your CDD flow ready for the AMLR?
- 1 Jan 2028 US Are your adviser clients ready for FinCEN’s AML rule?
- 31 Mar 2029 AU Is your initial CDD on the new AUSTRAC model?
- Now AU Tranche 2 is live. Is your AML/CTF program running?
UK GDPR for KYC: lawful basis, retention and sensitive data in AML checks
Firms that verify and screen clients under the Money Laundering Regulations handle personal data that UK GDPR protects, some of it in its most sensitive categories. The MLRs answer several UK GDPR questions directly.
- Regulation 41 of the Money Laundering Regulations 2017 says personal data obtained for AML purposes may only be processed to prevent money laundering, terrorist financing or proliferation financing, unless another law permits it or the person consents.
- Regulation 40 requires CDD records to be kept for five years after the business relationship ends, and then the personal data must be deleted unless an exception applies.
- Facial matching in identity checks uses biometric data, and adverse media or sanctions results can include criminal offence data, including unproven allegations. Both need a condition beyond an ordinary lawful basis.
- The ICO can fine up to £17.5 million or 4% of worldwide annual turnover, whichever is higher, for the most serious breaches.
What it is
UK GDPR is the UK's version of the EU General Data Protection Regulation, read together with the Data Protection Act 2018 (DPA 2018). The Data (Use and Access) Act 2025 amended both, mostly from 5 February 2026. The ICO says the Act amends, and does not replace, the existing law.
For professional firms, UK GDPR meets AML at client onboarding. Customer due diligence under the Money Laundering Regulations (MLRs) means collecting identity documents, often a selfie, ownership details and screening results. The MLRs include their own data protection rules in regulation 41 and record keeping rules in regulation 40.
Several ICO guidance pages, including those on biometric and criminal offence data, say they are under review after the 2025 Act.
Who it applies to
UK GDPR applies to every controller processing personal data in the UK. This page focuses on regulated professional firms carrying out KYC and AML checks on clients, their beneficial owners and the people acting for them.
- Accountants, tax advisers and insolvency practitioners
- Solicitors and conveyancers
- Estate agents and letting agents within the MLRs
- Trust and company service providers
What you have to do
The MLRs settle some UK GDPR questions for AML data. The rest each firm decides and documents under its own program.
- Identify and document a lawful basis
Regulation 41(7) of the MLRs says the public task basis in Article 6(1)(e) includes processing under the MLRs that is necessary to prevent money laundering, terrorist financing or proliferation financing. The ICO says to decide your lawful basis before you start processing.
- Tell new clients how their AML data is used
Before starting a relationship, regulation 41(6) requires firms to give the usual Article 13 privacy information and a statement that the data will be processed only to prevent money laundering, terrorist financing or proliferation financing, or as otherwise permitted.
- Meet a condition for biometric and criminal offence data
Facial matching for identification uses special category biometric data, and screening hits can be criminal offence data. Regulation 41(8) points to DPA 2018 Schedule 1, for example paragraphs 10, 11 and 12. Those Part 2 conditions generally need an appropriate policy document. The ICO says explicit consent is often the most appropriate condition for biometric recognition.
- Keep CDD records for the MLR period, then delete
Keep CDD records for five years from when the relationship ends or an occasional transaction completes. Transaction records in a relationship need not be kept beyond 10 years. After that, regulation 40(5) requires deleting the personal data unless another law, court proceedings or the person's consent requires retention.
Records - Assess high-risk processing
The ICO says a data protection impact assessment is needed for processing likely to be high risk, and expects firms to weigh the risks of processing criminal offence data.
Governance - Handle complaints and access requests
Since 19 June 2026 controllers must acknowledge data protection complaints within 30 days. For subject access requests, the Act confirms firms need only make reasonable and proportionate searches.
Process
What firms get wrong
AML and privacy duties are often seen as pulling against each other. The MLRs were written to fit with UK GDPR.
Regulation 41 limits AML data to preventing money laundering, terrorist financing and proliferation financing. Other uses need another legal permission or the person's consent.
Regulation 40 sets a minimum of five years after the relationship ends and then requires deletion of the personal data, subject to narrow exceptions. Keeping it longer without a reason is a UK GDPR risk.
The ICO says criminal offence data covers allegations and investigations as well as convictions, including unproven allegations. Adverse media and sanctions matches can fall in this category and need a Schedule 1 condition.
Questions people ask
What is UK GDPR?
The UK's general data protection law, based on the EU GDPR and read with the Data Protection Act 2018. The Data (Use and Access) Act 2025 amended it, mostly from 5 February 2026. See Data (Use and Access) Act 2025.
What is the lawful basis for AML checks under UK GDPR?
Regulation 41(7) of the MLRs says the public task basis includes MLR processing necessary to prevent money laundering, terrorist financing or proliferation financing. Firms should document the basis they rely on before processing.
How long should we keep KYC records in the UK?
At least five years from the end of the business relationship or the completion of an occasional transaction, under regulation 40 of the MLRs. Then the personal data must be deleted unless an exception applies.
Is a selfie check biometric data under UK GDPR?
When a face image is processed to identify or verify a person, the ICO treats it as special category biometric data that needs a separate condition. See biometric identity verification.
What are the UK GDPR fines?
Up to £17.5 million or 4% of worldwide annual turnover, whichever is higher, for the most serious breaches, and up to £8.7 million or 2% for others.
Primary sources
Checked 5 Nov 2026. We review this page every 90 days and when the rules change.
- legislation.gov.uk, MLR 2017 regulation 40 (record keeping)
- legislation.gov.uk, MLR 2017 regulation 41 (data protection)
- legislation.gov.uk, DPA 2018 Schedule 1 Part 2
- legislation.gov.uk, SI 2026/82 (DUAA Commencement No. 6)
- ICO, The DUAA: what does it mean for organisations?
- ICO, How do we process biometric data lawfully?
- ICO, Criminal offence data
- ICO, The maximum amount of a fine under UK GDPR and DPA 2018
Where StackGo fits
Each firm stays the controller and decides its own lawful basis, conditions and retention. IdentityCheck can reduce how much sensitive data spreads across a firm's systems.
- By default, no personal details are written back to connected systems (Xero Practice Manager, Xero, Karbon, HubSpot): they receive a link to the result plus the outcome and status
- Onboarding forms that collect the details a firm needs for CDD in one place
- Biometric identity checks and PEP, sanctions and adverse media screening, with ongoing monitoring of screened clients
- It does not decide a firm's lawful basis, write its appropriate policy document or DPIA, or give legal advice
- It does not run a firm's subject access or complaints process
Ready to make onboarding minutes, not hours?
Start free and run your first check today, or book a demo and we will walk you through it.