WebinarShufti x AML IntelligenceHow AMLR Extends KYC Across the Customer Lifecycle18th Sep | 02:00 PM UTCREGISTER NOW Shufti x AML IntelligenceHow AMLR Extends KYC Across the Customer Lifecycle18th Sep | 02:00 PM UTCREGISTER NOW How AMLR Extends KYC Across the LifecycleRegister One sign-up screen. One rulebook behind it;  AMLR, eIDAS 2.0, EUDI wallet.Read the GUIDE One sign-up screen. One rulebook behind it;  AMLR, eIDAS 2.0, EUDI wallet.Read the GUIDE AMLR, eIDAS 2.0 & EUDI walletRead the guide Shufti x FTAHKWebinarThe Lifecycle of a Compliant Crypto TransferTravel Rule, Wallet Verification & Counterparty Risk05:00 PM HKT9th September, 2026Register Now Shufti x FTAHKTravel Rule, Wallet Verification & Counterparty Risk9th September, 2026Register Now Compliant Crypto Transfer — Travel Rule & moreRegister Shufti x ACFEWebinarAI has changed fraud. Now we need to change how we fight it.Microphone icon for Shufti and ACFE fraud webinar5th October, 2026Register Now Shufti x ACFEAI has changed fraud. Now we need to change how we fight it.5th October, 2026Register Now AI has changed fraud — change how we fight itRegister INNOVATION DROPSUMMER
EDITION20
26Qualified Electronic SignatureWATCH NOW INNOVATION DROP - Qualified Electronic SignatureWatch Now Innovation Drop — Qualified Electronic SignatureWatch INNOVATION DROPSUMMER
EDITION20
26Transaction Trust MonitoringWATCH NOW INNOVATION DROP - Transaction Trust MonitoringWatch Now Innovation Drop — Transaction Trust MonitoringWatch INNOVATION DROPSUMMER
EDITION20
26Travel Rule ComplianceWATCH NOW INNOVATION DROP - Travel Rule ComplianceWatch Now Innovation Drop — Travel Rule ComplianceWatch G2 badgesShufti - The #1 Identity Verification Solution on G240+ Badges | Fall 2026 ReportExplore More Shufti - The #1 Identity Verification Solution on G2Explore more Shufti — #1 Identity Verification on G2Explore
Book a Demo

nl

2a04:52c0:121:9d3a::1

GDPR

Every data subject right is operationally supported not just written into a policy

Biometric data and identity documents are Article 9 special category personal data under GDPR, the most tightly regulated data category in EU law. Shufti processes this data under a documented legal basis, retains it only as long as you configure, and operationally supports every data subject right your users may exercise. Shufti GDPR Data Processing Agreement is included in the standard enterprise contract, not an optional add-on.

Book a Demo Contact Us
GDPR certification badge

Certification Overview

What GDPR Covers

Standard Personal Data

Name, email address, phone number, IP address, regulated under GDPR Articles 5 and 6. Requires a lawful basis for processing, reasonable security measures, and data subject rights. Most SaaS platforms operate under this category.

Article 9 Special Category Data

Biometric data used to uniquely identify a person, facial images, and identity document data, the most tightly regulated GDPR category. Requires explicit consent or legal obligation as processing basis, stricter security controls, mandatory data minimisation, full data subject rights support, and a documented Data Protection Agreement before any processing begins.

Why It Matters

Supervisory authorities, Italy's Garante, Ireland's DPC, and France's CNIL, have specifically investigated digital onboarding flows where verification providers retained biometric data beyond necessity, lacked a documented processing basis, or could not operationally support data subject rights. Enforcement actions followed against the businesses that contracted with those providers.

When a user exercises their right to erasure

Your team needs to operationally deliver it, not just acknowledge it. Shufti's API and admin console let you trigger deletion of individual verification records and receive a deletion confirmation as your audit evidence.

EUR 1.2B+

Assessed by an independent AICPA-registered auditor, not a point-in-time snapshot. All five Trust Services Criteria covered: Security, Availability, Processing Integrity, Confidentiality, Privacy.

Certification Assurance

Independently Verified Compliance Standards

Standard

Compliance framework, legal basis, or certification standard covered.

Assessed By

Independent auditor, authority, or responsible assessing party.

Scope

Systems, data flows, regions, features, or operational areas included.

Documentation

Reports, policies, registers, agreements, or evidence available.

How Shufti Maintains It

Shufti GDPR documentation package includes: the Article 28-compliant DPA, sub-processor register (updated within 30 days of any change), data retention and deletion policy, and technical documentation of how data subject rights are operationally supported. All available on request before you sign a contract.

EU-resident data is processed on EU infrastructure. UK-resident data is processed under UK GDPR. US and APAC regional deployments are available for non-EU data flows.