Anti-Money Laundering (AML) and GDPR

Data Retention and Compliance with AML, and how it relates to GDPR

At ZEW, we are committed to ensuring transparency and compliance with all applicable data protection laws. Below is an overview of how we process and retain personal data in line with GDPR and Anti-Money Laundering regulations.

Lawful Grounds for Processing Personal Data

Under Article 6(1)(c) of the GDPR, personal data may be processed and retained when it is necessary for compliance with a legal obligation.

This means that ZEW may retain personal data to fulfill statutory obligations, including those mandated by AML legislation.

Right to Erasure and Exceptions

While GDPR provides data subjects the right to request the erasure of their personal data under Article 17(1), there are exceptions to this right under Article 17(3).

Personal data cannot be erased if its retention is necessary to comply with a legal obligation imposed by Union or Member State law.

For example, data retained for AML compliance purposes is exempt from the right to erasure.

Retention Periods

Personal data required under AML regulations will be:

• Retained for the duration mandated by legal requirements.

• Promptly and securely deleted once the mandated retention period expires.

Balancing GDPR and AML Compliance

ZEW's data retention practices ensure compliance with both GDPR and AML statutory requirements. This dual compliance means:

• Personal data is processed lawfully and transparently.

• Legal obligations are satisfied without infringing on the principles of data protection.