AML and GDPR: purposes, roles and proportionate data scope

Start with a specific purpose

For each field, identify the duty served: identification, due diligence, risk analysis, evidencing actions or statutory retention. Section 17a(1) limits processing to what is necessary. GDPR Article 5 requires purpose limitation, minimisation, accuracy and appropriate duration. AML is not blanket permission to collect unlimited client or family information.

Article 6(1)(c) is relevant for legal obligations. Consent should not obscure that basis: withdrawal does not end statutory retention. Reassess the legal basis if you are not an obliged entity or use data for another purpose. Public registry availability does not itself remove data-protection rules.

Roles depend on the actual service

The obliged entity generally determines its AML-record purpose as controller. A provider may process on its instructions as processor, subject to Article 28. Other provider operations with independent purposes need separate role and legal-basis assessment. A processor label in a contract is insufficient where the provider actually determines further purposes.

Check storage, logs, support, backups and subprocessors. Brief storage or a no-store claim does not itself settle roles, transfers or security. Client queries should not enter URLs, advertising analytics or public search. Grant access by role and need rather than to all employees.

Provide information while respecting special restrictions

Section 24(2) requires pre-relationship or pre-transaction information, including a general AML notice. Section 17a(2) and confidentiality restrict information about specific AML processing. Handle access or erasure requests under GDPR and these special rules; do not disclose internal suspicious-transaction reports without assessment. After statutory retention, assess any evidenced basis for further storage.

Copying a file for another purpose

Do not automatically copy AML evidence into a sales database, marketing system or freely accessible team folder. The same worker may need an invoice for business tasks and only limited AML-file access. Separate purposes and permissions. For statistics or service improvement, assess actual anonymisation or a separate legal basis; removing a name alone may not prevent re-identification.

For client requests, verify the requester’s identity, locate relevant data and assess statutory exceptions. A response must not include protected internal circumstances simply because an export button includes the entire file. Conversely, a general AML label does not justify ignoring every request. Record the legal basis for response scope and continued retention. When the statutory purpose ends, deletion review also covers copies and provider access.