EU Sanctions Compliance Challenges Data Privacy Under GDPR

• •EU sanctions against Russia require extensive data collection for compliance.
• •GDPR restricts public access to personal data without legitimate interest.
• •Companies face a structural tension between sanctions compliance and data privacy.

The EU's expanding sanctions against Russia impose stringent Know-Your-Customer (KYC) requirements, which necessitate extensive data collection and processing. However, compliance with these sanctions must also adhere to the General Data Protection Regulation (GDPR). The Court of Justice of the European Union (CJEU) ruled in Case C‑798/24 (Jautiva) that GDPR prohibits national laws mandating the public availability of personal data for sanctions implementation without legitimate interest. This creates a conflict where increased data collection for sanctions compliance heightens exposure to data protection law violations. Companies must navigate this tension to ensure compliance with both sanctions and data privacy laws while managing the risks associated with personal data processing.