GDPR совместимость KYC

KYC generates massive PII collection — must comply с GDPR while meeting AML requirements.

Conflict areas

Data minimization vs comprehensive KYC. Purpose limitation vs multi-use. Retention limits vs 5+ years AML. Right to erasure vs regulator preservation. Cross-border vs local requirements. Careful navigation required.

Lawful basis

Legal obligation: AML compliance. Contract performance: service provision. Legitimate interest: fraud prevention. Consent для marketing (separate). Multi-basis approach. Documentation обязательна. Data Protection Impact Assessment (DPIA).

Data subject rights

Access: KYC documents included. Rectification: correct errors. Erasure: limited by AML. Restriction: pause processing. Portability: machine-readable. Object: marketing opt-out. Automated decision-making: KYC often involves automation.

Technical measures

Encryption at rest и transit. Access controls. Audit trails. Segregation KYC data. Retention policies automated. Cross-border transfers: SCCs. Vendor management: DPAs с KYC providers. Comprehensive privacy program.