EDPB and AMLA Prepare Guidance on Information-Sharing Partnerships and Data Protection Checks

The European Data Protection Board and the Anti-Money Laundering Authority announced joint work on guidelines for partnerships involving information sharing. The initiative addresses how information can be shared to support the fight against financial crime while protecting personal data.

For companies operating digital products, financial platforms, or complex data-processing environments, the relevant question is not only whether information can move between participants. The business process must also show who handles the data, under which role, and what evidence supports the transfer.

Check participant roles before sharing information

Information-sharing models depend on the actual structure of the process. Before changing a product flow or partnership model, companies should map:

• which personal data categories are used;
• who decides processing purposes and who acts on instructions;
• which contracts define responsibilities between participants;
• which approvals and records support the processing activity.

This review also matters in a corporate transaction where a buyer or seller evaluates a digital asset, platform, or business with significant data flows. Transaction checks should include how data responsibilities, contractual obligations, and operational processes move between parties.

Preserve evidence and separate confirmed facts from open questions

The future guidelines may provide additional clarity on specific information-sharing partnerships. The announcement itself does not establish a single approach for every data-processing model and does not resolve questions that depend on jurisdiction, contract wording, or actual business operations.

Companies preparing for review can organize an evidence package containing:

• data-flow maps;
• agreements with vendors and partners;
• records describing controller and processor roles;
• access logs, process changes, and internal review records.

If a dispute, claim, regulator inquiry, or authority request arises, these materials can help explain the factual processing model and the basis for company actions. Evidence preservation is especially relevant because outcomes in individual matters depend on documents, roles, and specific circumstances.

Before implementing a new information-sharing process, businesses should review the applicable requirements with counsel where personal data, cross-border operations, or multiple contractual participants are involved.