.svg "ZealiD Logo New (1)"){kind=small}
GDPR and EU data
GDPR for firms that hold client ID documents
Passports, selfies and signed contracts are personal data, and some of it is special category. GDPR asks you to keep it secure, keep it only as long as you need it, and know who processes it. Trust Circle keeps client documents in Stockholm, shares them only with verified people, and comes with a published data processing agreement.
From €40 a year · Identity verification included, no fee per check
GDPR ART 5, 28 AND 32
Key dates
Three dates behind the rules on client data
The EU General Court dismissed the challenge to the EU-US Data Privacy Framework (case T-553/23). An appeal to the Court of Justice is pending, so transfers to the US can still change.
From 10 July 2027, the EU AML Regulation also sets how long you keep client due diligence records. Trust Circle and AMLR →
What GDPR asks
You are the controller of your client files. Choose processors you can account for.
What GDPR asks of your firm
- Keep personal data no longer than you need it
Art 5(1)(e) - Protect it against unauthorised access and loss
Art 5(1)(f), 32 - Treat biometric data used to identify someone as special category
Art 9 - Sign a processing contract with every processor
Art 28(3) - Report a personal data breach to your authority within 72 hours
Art 33 - Assess the risk before large-scale processing of special-category data
Art 35(3)(b)
Two roles to get right
Your client files.
Your firm is the controller. For the documents and client data you manage in Trust Circle, ZealiD processes them on your behalf under the Trust Circle DPA.
The identity check behind a qualified signature.
eIDAS requires ZealiD, as a qualified trust service provider, to verify the signer itself. For that check, ZealiD is a controller in its own right. eIDAS Art 24(1)
Email or Trust Circle
Where client data ends up
GDPR, article by article
Where Trust Circle helps with client data
Article numbers refer to Regulation (EU) 2016/679 (GDPR). Your records of processing, privacy notices and retention schedule remain your own.
Common mix-ups
Three things firms often get wrong about client ID data
01
Consent isn't the only legal basis.
AML checks rest on a legal obligation (Art 6(1)(c)). From July 2027, AMLR Art 76 also lets you process special-category data where it is strictly necessary for AML.
02
A photo isn't always biometric data.
A picture becomes biometric data when it is processed by specific technical means to identify someone, as in a face match (recital 51).
03
Deleting is part of the job.
AMLR asks you to keep due diligence records for 5 years after the relationship ends, and then to delete them (Art 77).
Where Trust Circle stands: client documents are stored in Stockholm, and the Trust Circle DPA and our privacy policy are published in our Repository.
Open the Repository →What stays with your firm
Your legal basis and notices
You decide why you process client data and tell clients in your privacy notice.
Your retention schedule
You set how long each type of record is kept, in line with AML and national rules.
Your risk assessment
Where your processing calls for a data protection impact assessment, it is yours to carry out.
Trusted by banks, law firms and platforms
We are building a future-proof bank, digital by design… Our business clients can now sign their credit and guarantee documentation digitally with ZealID, a provider of qualified electronic signatures and a partner of ABN AMRO.
Meets German AML rules (GwG)
DocuSign resells ZealiD's qualified signature, with ID document data, to its customers in German finance for remote identification.
Read the case study →Qualified Trust Service Provider
Check us on the EU Trusted List, not on our word
- Listed on the EU Trusted List (Sweden): qualified certificates for electronic signatures, qualified timestamps and remote qualified signature creation
- Supervised by PTS, the Swedish Post and Telecom Authority
- Audited every year by TÜViT
- Identity checks certified against ETSI TS 119 461
- Documents stored in Stockholm, EU
ZealiD AB
QUALIFIED TRUST SERVICE PROVIDER
LISTED SERVICES · SWEDEN
Pricing
Secure sharing in every plan
Micro
€40a year
- 10 QES a year
- 1 user
Solo
€15.20a month, billed yearly
- 5 QES a month
- 1 user
Starter
€39.20a month, billed yearly
- 15 QES a month
- Up to 3 users
Professional
€119.20a month, billed yearly
- 75 QES a month
- Up to 10 users
Every plan includes identity verification, with no fee per check. See all plans →
Take client documents out of your inbox
Verify each client once, share documents with verified people only, and keep every file with the client it belongs to.
Questions about GDPR and client data
Where are client documents stored?
In Stockholm, Sweden, inside the EU.
Is ZealiD our processor or a controller?
Both, for different things. For the documents and client data your firm manages in Trust Circle, ZealiD is your processor under the Trust Circle DPA. For the identity check behind a qualified signature, eIDAS makes ZealiD a controller in its own right.
Where can we read the data processing agreement?
The Trust Circle DPA is published in our Repository, next to our terms and privacy policy. Open the Repository.
Is a client's selfie biometric data?
When it is processed by specific technical means to identify the person, as in a face match, yes. Then it is special-category data under Art 9 GDPR.
Do we need the client's consent for KYC?
AML checks rest on a legal obligation, not on consent. Trust Circle still asks the client to consent before their KYC data is shared with your firm.
Is the EU-US Data Privacy Framework still valid?
Yes, for now. The EU General Court dismissed the challenge on 3 September 2025 (T-553/23). An appeal to the Court of Justice is pending.
How long can we keep ID documents?
Only as long as you need them. For AML records, AMLR sets 5 years after the relationship ends, then deletion, from 10 July 2027.
Does Trust Circle make us GDPR compliant?
No tool does that on its own. Trust Circle gives you secure storage in the EU, verified access and a published DPA. Your legal basis, notices, retention schedule and risk assessments stay with your firm.