united-kingdom gdpr data-protection investment
What is the lawful basis for running Know Your Customer (KYC) checks on startup investors?
<p>Suppose you have a startup that raises money from a number of angel investors, many of whom are investing as natural persons.</p>
<p>What is the lawful GDPR basis for processing the investors' personal data, including their name, address, and photo IDs?</p>
<p>My guess would be either Contract or Legal Obligation (to comply with AML regulations).</p>
<p>A subscription agreement cannot be drafted without the investor's personal details. However, it can be drafted without a photo ID, but the photo ID is necessary to check the identity of the investor against an AML database.</p>
<p>Note: this question is about a UK company and so about the UK Data Protection Act, but since that is basically a copy-and-paste of GDPR, this question applies to EU companies as well.</p>

<p><a href="/questions/tagged/england-and-wales" class="post-tag" title="show questions tagged &#39;england-and-wales&#39;" aria-label="show questions tagged &#39;england-and-wales&#39;" rel="tag" aria-labelledby="england-and-wales-container">england-and-wales</a></p>
<p>'Know Your Customer' (KYC) is a synonym for 'customer due diligence' checks.</p>
<p><a href="https://www.legislation.gov.uk/uksi/2017/692" rel="nofollow noreferrer">The Money Laundering Regulations</a> refer to '<a href="https://www.legislation.gov.uk/uksi/2017/692/part/3" rel="nofollow noreferrer">customer due diligence</a>' and not to KYC, so searching the regs for Know Your Customer or KYC will have no results. But you can <a href="https://www.handbook.fca.org.uk/handbook?site-search=know%20your%20customer" rel="nofollow noreferrer">search the Financial Conduct Authority's handbook for &quot;Know Your Customer&quot;</a> or &quot;KYC&quot; and eventually arrive at useful information.</p>
<p>The Regulations create legal obligations to apply 'customer due diligence measures' that necessarily involve the processing of some personal data.</p>
<p>As Dale M said, one of the six lawful bases for processing personal data is 'legal obligation' (<a href="https://www.legislation.gov.uk/eur/2016/679/article/6" rel="nofollow noreferrer">Article 6(c) GDPR</a>): &quot;processing is necessary for compliance with a legal obligation to which the controller is subject&quot;.</p>

<h2>Legal obligation</h2>
<p>One of the basis for collecting data under GDPR is a legal obligation. Assuming KYC is a legal requirement, this is satisfied.</p>
