GDPR in Sanctions and PEP Screening: Data, Legal Basis and Decisions

Sanctions and PEP screening can involve customer details, beneficial-owner information, public records and analyst conclusions about identifiable people. Where EU GDPR applies, the company needs a defined purpose and an appropriate legal basis for that processing. It must also address accuracy, transparency, rights, security and retention. A compliance objective or an internal screening policy does not settle those questions on its own.¹

This guide covers the EU GDPR framework, with sources checked on 21 October 2026. National AML rules, applicable sanctions measures and sector requirements still need to be identified for the particular business. The practical sanctions screening guide explains the wider control process; this page focuses on how personal data moves through it.

Distinguish the duty, company policy and lawful basis

Start with the activity: onboarding a customer, reviewing a beneficial owner or checking a supplier. Identify whose personal data is needed and why. Sanctions restrictions and AML duties to identify PEPs are different legal frameworks; their scope must be assessed separately.

A legal obligation need not prescribe a particular software product or matching method. Explain why the chosen processing is necessary to fulfil the actual duty. A foreign-law requirement or commercial request should not simply be treated as an EU or Member State legal obligation under Article 6(3).¹

For Article 6(1)(f), document the interest, less intrusive alternatives, reasonable expectations, potential consequences and safeguards. Screening for business risk may be a candidate for this assessment; it is not a guaranteed outcome. This basis is not available to public authorities when processing in the performance of their tasks.²

Consent is one of the possible bases, not a universal screening requirement. It must meet the applicable conditions, including being freely given, specific, informed and unambiguous. If the firm cannot genuinely allow withdrawal because processing is legally required, consent is unlikely to fit that purpose. Ordinary consent under Article 6 is not always subject to the explicit-consent requirement that applies in certain other GDPR provisions.²

Select data that helps resolve identity

For each population, decide which information is necessary. Names and available dates of birth, roles, countries or ownership relationships may help distinguish candidates. That does not make every field necessary in every case, or justify routinely collecting identity-document numbers from everyone.

Keep customer-supplied facts, source information and analyst conclusions distinguishable. Record where information came from and when it was checked. Missing identifiers should remain visible as uncertainty, rather than being replaced with an assumption that a similar name is the same person.

Purpose limitation, minimisation and accuracy apply to the information used and generated. A false association with a sanctioned person is itself a data-quality problem. A corporate record can also contain personal data about directors or owners; the company name alone does not describe the full processing.¹

Assess sensitive and criminal-offence information

Do not decide the data category from the label “PEP” alone. A public-office fact does not automatically establish a political opinion, but a party role, contextual information or an inference may reveal political opinions or another Article 9 category. Assess what the information actually reveals. Where Article 9 applies, an Article 6 basis alone is insufficient; a relevant Article 9(2) condition must also be established.¹³

Similarly, a sanctions record is not automatically a criminal conviction record, but its contents may relate to offences, convictions or related security measures. Article 10 is not confined to formal criminal-record databases. Where it applies, processing needs official-authority control or authorisation by EU or Member State law providing appropriate safeguards, in addition to the Article 6 basis. Do not assume that legitimate interests alone resolves this requirement.¹³

Public availability is not a general exemption. A public designation, political profile or search result still needs a lawful purpose, relevant conditions and the other applicable GDPR protections.

Plan how people will be informed

Article 13 concerns information collected from the individual, with information generally provided when the data is obtained; Article 14 concerns information obtained elsewhere. A customer contact's receipt of a notice does not by itself settle the notice position of every beneficial owner or supplier director.

For Article 14, information is generally due within a reasonable period and no later than one month after obtaining the data. Earlier triggers can apply: at the latest on the first communication with the person, or when the data is first disclosed to another recipient, as relevant. The notice needs the applicable information about purposes, basis, categories, sources, recipients, retention and rights.¹⁴

A notice does not necessarily require a separate message for every repeated check if the processing is already properly explained. But a vague website statement that “background checks may occur” is not automatically sufficient. Consider what is actually provided, to whom and when.

Article 14 exceptions have conditions. Assess and record the particular ground and any required safeguards. Relevant legal restrictions may also affect disclosure. “AML”, possible inconvenience or a large screening population is not a blanket reason to withhold privacy information. General information about screening and disclosure of a particular investigation are different questions.⁴

Assign responsibility across the company and provider

Map the processing operations before assigning controller and processor roles. A service provider may act on customer instructions for one operation and determine its own purposes for another. Contract labels do not decide the factual role. EDPB guidance explains these functional distinctions.⁵

Where a processor is used, address the Article 28 requirements, instructions, subprocessors and assistance with rights and deletion. Where parties act as separate or joint controllers, assess the relevant responsibilities and sharing arrangements instead. Sharing within a corporate group is not automatically unrestricted.¹⁵

For procurement, establish where data is hosted and accessed, which parties receive it, the security measures and any international transfers. An Article 28 agreement does not itself settle a Chapter V transfer requirement. Verify the relevant mechanism and safeguards for the actual arrangement; do not infer them from a vendor's location or a “GDPR compliant” label.¹

Review automation and privacy risk before rollout

Article 22 concerns decisions based solely on automated processing that produce legal or similarly significant effects. Candidate generation is different from a decision to deny an account or terminate a relationship. Assess the real workflow and consequences; an analyst clicking “approve” without meaningful assessment does not necessarily make the decision a human one.¹⁶

Article 22 contains exceptions and safeguards, so “all automated decisions are prohibited” is too broad. Establish whether the provision applies and whether a relevant exception and protections are satisfied. The exceptions concern contract necessity, authorisation by applicable EU or Member State law, or explicit consent, each subject to its conditions. Article 22(3) provides specific safeguards for the contract and consent exceptions, and Article 22(4) imposes additional limits on special-category data. A vendor's scoring feature does not answer this for the buyer's process.¹

Assess whether the processing is likely to result in high risk under Article 35, taking account of its nature, scope, context and purposes, applicable supervisory lists and guidance. Scale, profiling, sensitive information and effects on individuals may matter. The use of software or AI alone does not determine whether a data protection impact assessment is required. Complete a required assessment before processing starts. If high residual risk cannot be sufficiently mitigated, assess the prior-consultation requirement under Article 36 before proceeding.¹

Handle a challenge without preserving a false accusation

Prepare a route for access, correction, restriction, objection and erasure requests. Which rights apply, and any exceptions, depend on the processing and legal basis. For an Article 21 objection to legitimate-interest processing based on the person's particular situation, stop the processing unless the company demonstrates compelling legitimate grounds that override the person's interests, rights and freedoms, or the processing is needed for legal claims. An objection is not identical to an erasure request. Apply the Article 12 response requirements and any applicable lawful restrictions.⁷

When someone disputes a match, check identity and the accuracy of the association. Correct an incorrect customer-to-candidate link and review any downstream decisions or disclosures. Where applicable, Article 19 requires communicating rectification, erasure or restriction to recipients, subject to its conditions.¹

Resolving a false positive does not mean no personal data ever existed. Nor does it automatically require deleting every trace of the review. Decide what correction and minimised decision evidence are necessary and lawful, what should be restricted while accuracy is checked, and what should be removed. Do not promise deletion of an external authority's list entry when the error is in the company's own match decision.

Give each record category its own retention rule

Avoid one retention period for everything called “screening data”. Separate the purpose, applicable rule, start date, review date and deletion arrangements for each category.

Article 5 requires storage limitation. Applicable statutory retention or properly justified legal-claims needs can affect deletion, but “audit” is not an unlimited retention basis. Check each exception and its scope. The Germany PEP guide gives one national recordkeeping example; its periods must not be transferred to every EU workflow or vendor log.¹

Three fictional screening situations

A regulated firm checks a beneficial owner

The team identifies the applicable AML duty, the relevant person and necessary data, then assesses the processing under Article 6. It separately reviews any Article 9 or 10 information. The file connects the candidate investigation, outcome, notice arrangements and applicable record rule. A corporate customer's notice is not assumed to cover the beneficial owner automatically.

A company extends supplier checks under its own policy

The company wants to screen people connected to suppliers. It separates any applicable sanctions duties from additional internal checks, defines the purpose and tests whether legitimate interests or another basis can support the added processing. It considers a narrower population and less intrusive data. If the assessment fails, the policy must change rather than serving as permission by itself.

A person challenges a similar-name match

The reviewer checks the disputed identity, corrects the erroneous association and follows the rights process. The company assesses recipients, downstream effects and whether processing should be restricted while accuracy is verified. Any retained review evidence must have a defined justification. The person is not denied information merely because they were never a customer.

Evaluate software against the decisions your team must explain

Checklynx groups source results into profiles and presents enriched, structured information for review. That context can help teams compare candidates; it does not establish the buyer's lawful basis, grant a transparency exemption or decide how long every record should be kept.

When assessing sanctions screening software or PEP screening software, ask how the proposed configuration supports necessary data, provenance, reviewer decisions, access and correction. Verify retention, deletion, security, subprocessors and transfer arrangements in current documentation and contracts. The software buyer guide covers the wider procurement process. Checklynx's privacy policy describes its practices; this guide does not change those terms.

Frequently asked questions

Does a public sanctions list remove GDPR obligations?

No. Public availability does not establish the legal basis, remove transparency duties or decide the conditions for sensitive or criminal-offence information. Assess the actual processing and information used.

Can company policy require broader checks than the law?

A company can propose additional risk controls, but the personal-data processing still needs its own valid basis and must meet the other applicable requirements. The policy cannot create that basis merely by declaring screening mandatory.

Must every screening result be deleted after a non-match?

Not automatically. Correct inaccurate associations, remove unnecessary data and determine whether a limited, accurate decision record has a lawful continuing purpose or retention obligation. A non-match does not justify indefinite storage either.

Does buying screening software make the process GDPR compliant?

No. Software, contracts and technical controls are parts of the arrangement. The company still needs to establish purpose, scope, legal basis, relevant data conditions and operating responsibilities for its use.