GDPR Compliance for Regulated Businesses
Gambling operators and financial institutions process large amounts of sensitive customer data. We build GDPR programs that also meet sector rules on KYC, retention and regulator access.
Updated 28 October 2026 · General information, not legal advice
What the work covers
Data mapping
Records of processing, legal bases and retention.
DPIAs
Assessments for profiling, monitoring and new technologies.
Transfers
Transfers outside the EEA to group companies and vendors.
Incidents
Breach response and notification to ANSPDCP.
- Conflicting duties. AML retention duties and GDPR minimization must be reconciled.
- Marketing. Consent rules for direct marketing are strict.
- Vendors. Processors need GDPR-compliant contracts.
- GDPR gap analysis
- Policies and notices
- DPIAs and transfer assessments
When must a breach be notified to ANSPDCP?
Within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk to individuals.
Does GDPR allow AML data retention?
Yes. Retention required by Law 129/2019 is a legal obligation under GDPR, but data should not be kept longer than the law requires.
Tell us the decision you need to make
Describe the transaction or regulatory issue, the Romanian assets involved and your timetable.
Consultation