Every processing activity needs a lawful basis. A payment or e-money firm runs most of its processing on "legal obligation" (AML checks, transaction records) and "contract" (executing the payment), and uses consent mainly for marketing. Article 22 restricts decisions based solely on automated processing that have legal or similarly significant effects, so a lender that refuses credit purely on a model's output must offer human review and a way to contest it. The distinction matters: data kept under an AML legal obligation must be retained for the statutory period even if a customer asks for erasure, while marketing data must be deleted when consent is withdrawn.

Fintechs process large volumes of identity documents, account numbers and transaction histories, which is why know your customer files are usually the most sensitive data set in the company. Sharing data with processors, from cloud hosts to KYC vendors, requires a written data processing agreement, and transfers outside the EEA need a legal mechanism such as an adequacy decision or standard contractual clauses.

Article 83 sets two tiers. Breaches of obligations such as security and record-keeping can cost up to €10 million or 2% of total worldwide annual turnover for the preceding year, whichever is higher. Breaches of the core principles, data subject rights or international transfer rules can cost up to €20 million or 4%. For a group with €800 million turnover, the upper cap is €32 million, not €20 million.

The largest fine to date came from Ireland's Data Protection Commission in May 2023: €1.2 billion against Meta for transferring EU user data to the United States without adequate safeguards.

Under Article 33, a controller must notify its supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, with reasons for any delay. Financial entities also report major ICT incidents under DORA, which has its own, shorter clock, so a single ransomware attack at a payment institution can trigger two separate filings to two different authorities.

Buyers review the record of processing activities, data processing agreements with every vendor, international transfer mechanisms, breach logs and any regulator correspondence. Data that was collected without a valid lawful basis cannot simply be migrated to the buyer's systems after completion, which can reduce the value of a customer base. Undisclosed breaches are usually covered by specific indemnities in the share purchase agreement rather than general warranties.