Fintech AI: key go-global obligations

The hardest obligations in this segment

• Designation of an EU representative by third-country controllers and processorsEuropean Union · High

  A controller or processor that is caught by Art. 3(2) but not established in the EU must designate an EU representative in writing, established in one of the Member States where the relevant data subjects are. The representative must be mandated to be addressed, in addition to or instead of the controller or processor, by supervisory authorities and data subjects on all processing-related issues. The only exemptions are processing that is occasional, does not include large-scale processing of Art. 9(1) special categories or Art. 10 criminal-conviction data, and is unlikely to result in a risk to natural persons; and public authorities.

• Designation and independence of the data protection officerEuropean Union · High

  A DPO must be designated in three cases: processing carried out by a public authority or body, except courts acting judicially; where the core activities of the controller or processor consist of processing operations that, by their nature, scope or purposes, require regular and systematic monitoring of data subjects on a large scale; or where the core activities consist of large-scale processing of Art. 9 special categories or Art. 10 criminal-conviction data. The DPO must be designated on the basis of professional qualities, in particular expert knowledge of data protection law and practice, and may be a staff member or fulfil the tasks under a service contract. A group of undertakings may appoint a single DPO provided the DPO is easily accessible from each establishment.

• Records of processing activities (ROPA)European Union · High

  Controllers and their representatives must maintain records of processing activities under their responsibility, containing at least the name and contact details of the controller, joint controllers, representative and DPO; the purposes of processing; the categories of data subjects and of personal data; the categories of recipients including recipients in third countries; identification of third countries and the safeguards used for transfers; the envisaged erasure time limits for each category; and a general description of the Art. 32(1) technical and organisational security measures. The Art. 30(5) exemption for organisations with fewer than 250 employees is very narrow: it does not apply where the processing is likely to result in a risk to data subjects’ rights and freedoms, is not occasional, or involves special categories or criminal-conviction data.

• Lawful basis and transparency for training and inferenceEuropean Union · Critical

  Each processing activity, including training or fine-tuning models on user data, must have a documented Art. 6 lawful basis; processing of Art. 9(1) special categories additionally requires an Art. 9(2) exception. Where consent is relied on, it must meet the Art. 4(11) and Art. 7 requirements of being freely given, specific, informed and unambiguous, withdrawable at any time and as easily as it was given. Where legitimate interests are relied on, a three-part balancing test must be performed and retained. Information to data subjects must cover all Art. 13 and 14 elements, and Art. 14(3) requires notice within a reasonable period and at the latest within one month where data was not obtained from the data subject.

• Data subject request handling within the one-month deadlineEuropean Union · High

  Build a demonstrable process covering access, rectification, erasure, restriction, portability, objection and rights relating to automated decision-making. Under Art. 12(3), the controller must inform the data subject of the action taken without undue delay and in any event within one month of receipt, extendable by two further months for complex or numerous requests provided the data subject is informed of the extension and the reasons within the first month. Responses are free of charge except for manifestly unfounded or excessive requests. For AI companies the hard part is locating and acting on personal data that has entered training sets and vector indexes, and explaining whether it remains reproducible in model outputs.

• Data protection impact assessment and prior consultationEuropean Union · High

  Where a type of processing, in particular using new technologies and taking account of its nature, scope, context and purposes, is likely to result in a high risk to natural persons’ rights and freedoms, the controller must carry out a DPIA before processing. Art. 35(3) lists three mandatory cases: systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions producing legal or similarly significant effects are based; large-scale processing of Art. 9(1) special categories or Art. 10 criminal-conviction data; and systematic monitoring of a publicly accessible area on a large scale. The DPO’s advice must be sought where one is designated. Where the DPIA indicates a high residual risk absent mitigation, the supervisory authority must be consulted before processing (Art. 36).

• Restrictions and safeguards for solely automated decisionsEuropean Union · High

  A data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them. Only three exceptions apply: the decision is necessary for entering into or performing a contract between the data subject and the controller; it is authorised by Union or Member State law laying down suitable safeguards; or it is based on the data subject’s explicit consent. In the contract-necessity and explicit-consent cases the controller must implement suitable safeguards including, at least, the right to obtain human intervention, to express a point of view and to contest the decision. Such decisions must not be based on Art. 9(1) special categories unless Art. 9(2)(a) or (g) applies with suitable safeguards in place.

• Personal data breach notification within 72 hours and communication to data subjectsEuropean Union · Critical

  On a personal data breach the controller must notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to natural persons’ rights and freedoms; a notification made later must be accompanied by reasons for the delay. The notification must at least describe the nature of the breach including the categories and approximate numbers of data subjects and records concerned, give the DPO or other contact point, describe the likely consequences, and describe measures taken or proposed. Information may be provided in phases. A processor must notify the controller without undue delay after becoming aware. Where the breach is likely to result in a high risk, the controller must also communicate it to the data subjects without undue delay in clear and plain language. The controller must document all breaches, their effects and the remedial action taken, so the authority can verify compliance.

• Processor contracts and sub-processor managementEuropean Union · High

  A controller may only use processors providing sufficient guarantees to implement appropriate technical and organisational measures, and the processing must be governed by a contract or other binding legal act setting out the subject matter, duration, nature and purpose of processing, the types of personal data and categories of data subjects, and the controller’s rights and obligations. A processor must not engage another processor without prior specific or general written authorisation from the controller; under a general authorisation the processor must inform the controller of intended additions or replacements, giving it the opportunity to object.

• Security of processing and data protection by design and by defaultEuropean Union · High

  Controllers and processors must implement appropriate technical and organisational measures ensuring a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks to natural persons. Measures may include pseudonymisation and encryption; the ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services; the ability to restore availability and access in a timely manner after an incident; and a process for regularly testing, assessing and evaluating effectiveness. Data protection by design and by default must also be implemented at the time of determining the means of processing and during the processing itself (Art. 25).

• Transfer mechanisms and assessments for sending personal data to China and other third countriesEuropean Union · Critical

  Transfers of personal data to a third country or international organisation are permitted only under Chapter V: an adequacy decision of the Commission (Art. 45); appropriate safeguards (Art. 46, including Commission-adopted standard data protection clauses, binding corporate rules, approved codes of conduct or certification mechanisms, together with enforceable data subject rights and effective remedies); or the Art. 49 derogations for specific situations. China is not covered by an EU adequacy decision, so the default route for Chinese AI companies is to execute standard contractual clauses and complete a transfer impact assessment identifying how the destination country’s law affects the effectiveness of those clauses, and to adopt supplementary measures.

• Establish a headcount methodology and run the two-year audit cycle once the threshold is crossedChina (Mainland) · High

  The threshold is the single factual entry point to this regime, so first count — and evidence — how many individuals’ personal information is processed. Write the methodology down: a de-duplicated count of identifiable natural persons, covering active users, dormant users, deactivated accounts still inside the retention window, end users reached through an SDK or entrusted processing, individuals captured offline, and non-product data such as employees and candidates; and set explicit rules for merging users who overlap across product lines and legal entities, without which each self-check produces a different number. Once more than 10 million individuals’ personal information is processed, an audit is required at least every two years (Art. 4). Falling below the threshold is not an exemption: Art. 3 requires the processor to have its internal function or an engaged institution audit compliance “regularly”, so the company must fix its own cycle in writing — commonly aligned with the annual internal-control or security assessment cadence. File each count, the basis and date of the determination, and the scheduled date of the next audit; that file is the only material that shows a regulator the cycle has not been allowed to slip.

• Scope the audit and build the working papers against the annexed official GuidelinesChina (Mainland) · High

  Art. 6 requires both self-initiated and mandated audits to follow the annexed Guidelines, whose 27 sections amount to a ready-made audit programme: lawful basis and consent (including re-consent after changes, separate consent and written consent); processing rules set out as a list with the shortest necessary retention period; notice that is prominent and readable; agreements and supervision for joint and entrusted processing; notice when personal information transfers on a merger, restructuring, division or dissolution; separate consent and a prior impact assessment before providing personal information to others; transparency, fairness and a refusal mechanism for automated decision-making; consent-based public disclosure; necessity and signage for image-collection equipment in public places; the limits on processing already-public personal information; sensitive personal information and minors under 14; the three outbound routes and approval before providing information to foreign judicial or law-enforcement authorities; the six grounds for deletion and the duty to stop processing where deletion is technically infeasible; handling and responding to individuals exercising their rights; explaining the processing rules; internal management systems and operating procedures (classification, emergency mechanisms, impact assessment and audit systems, complaints, operating permissions, training, performance appraisal, and accountability for unlawful processing); the effectiveness of security technical measures (confidentiality, integrity and availability, encryption and de-identification, access control); coverage and assessment of training; the personal information protection officer’s qualifications, authority and registration with the authority; the conduct and content of impact assessments; the comprehensiveness of emergency plans and drills; incident response; and, for major platforms, platform rules and the personal information protection social responsibility report. In practice: map all 27 sections onto your own systems, data flows and policy documents to produce working papers with four columns — review point, evidence, owner, conclusion. For AI companies the recurring gaps are the lawful basis for training corpora, retention and deletion of conversation logs, whether personal information in models and logs can actually be deleted, and explanations of automated decisions in recommendation and risk control; evidence those first.

• Handle a mandated audit: selecting the institution, meeting the deadline, filing the report and reporting remediationChina (Mainland) · Critical

  This is the mandatory track alongside self-audits, and the regulator sets the tempo. Three triggers (Art. 5): processing that carries significant risk such as serious impact on individual rights or a serious lack of security measures; processing that may infringe the rights of numerous individuals; or a personal information security incident causing the leakage, alteration, loss or destruction of more than 1 million individuals’ personal information or more than 100,000 individuals’ sensitive personal information. The same incident or risk may not be made the basis of a second mandated audit, which is a point to raise if a duplicate demand arrives. Once mandated: select the professional institution as the protection department requires (it is not a free choice), complete the audit within the time limit, and, where the matter is complex, obtain the department’s approval for a reasonable extension (Art. 9); provide the support the institution needs and bear the cost (Art. 8); file the institution’s audit report with the department on completion, signed by the institution’s principal and by the audit lead and bearing the institution’s seal (Art. 10); and remediate the findings as required, filing a remediation report WITHIN 15 WORKING DAYS OF COMPLETING THE FIXES (Art. 11). In practice, build this chain into the incident response plan: once an incident’s severity reaches the 1 million / 100,000-sensitive scale, start preparing for a possible mandated audit in parallel — shortlist institutions, identify the budget line and settle the cooperation posture — rather than beginning the search after the clock has already started.

• Appoint the personal information protection officer and, for major platforms, an independent oversight bodyChina (Mainland) · High

  Art. 12 attaches the audit work to named people and bodies. First: a processor handling more than 1 million individuals’ personal information must appoint a personal information protection officer responsible for the organisation’s compliance audit work — note that this threshold (1 million) sits below the 10 million mark that triggers the mandatory two-year cycle, so many companies hit “you need an officer” before “you need a scheduled audit”. Section 22 of the Guidelines adds what is reviewed about that officer: relevant experience and professional knowledge and familiarity with the applicable laws and regulations; clearly defined duties and sufficient authority to coordinate internal departments; the right to give views before major processing decisions are taken; the power to stop non-compliant operations and take necessary corrective measures; and publication of the officer’s contact details, with the name and contact details filed with the protection department. Second: a processor providing important internet platform services with a very large user base and complex business types must set up an independent body composed mainly of external members to supervise the compliance audit — “mainly external” means a committee dominated by internal executives does not qualify, and the membership, rules of procedure and supervisory conclusions all need to be documented.