Ownership registers exist because transparency serves a public interest. Access to the data they hold is governed by a separate legal question: on what basis does a register disclose information about a natural person who controls a company? That question — the data protection basis — determines what a cross-border buyer can obtain, from which source, and under what conditions.
Control is the operative concept. The data protection framework does not treat all ownership data identically. A registered director is a public officer. A beneficial owner disclosed under an anti-money-laundering directive occupies a different position. A shareholder in a private company sits in a third category. Each category carries a different legal basis for disclosure, and each basis sets a different ceiling on what an external party can retrieve.
What the question determinesWhether a register may disclose ownership data to a third party, and on what legal ground — legitimate interest, legal obligation, or public-interest task. Primary framework (EU/EEA)GDPR Article 6 governs lawfulness of processing; the applicable basis for public registers is typically Article 6(1)(c) (legal obligation) or Article 6(1)(e) (public task). Source: GDPR text · verified 2026-09-01 Post-CJEU C-37/20 positionThe Court of Justice of the EU ruled in November 2022 that unrestricted public access to UBO registers is incompatible with GDPR. Member states now require a demonstrated legitimate interest for UBO data. Source: CJEU judgment C-37/20 · verified 2026-09-01 What this means for accessThe legal basis an applicant can assert — and whether the register accepts it — controls the scope of disclosure before any fee or procedure is considered.Three distinct bases appear across the registers most relevant to ownership verification.
Legal obligation (Article 6(1)(c) GDPR). A register established by statute to record company officers and shareholders processes that data under a legal obligation. The controller — the registrar — has no discretion to withhold data that the founding legislation requires to be public. Director names, registered addresses, and filed constitutional documents typically fall here. The data subject's objection does not override the statutory mandate.
Public task (Article 6(1)(e) GDPR). Registers maintained for regulatory supervision — including certain insolvency and enforcement registers — process data in the exercise of a public task. Access by third parties is narrower. The register may restrict disclosure to parties who can demonstrate a connection to the supervisory purpose.
Legitimate interest (Article 6(1)(f) GDPR). UBO registers in EU member states, following C-37/20, require the applicant to assert a legitimate interest. The register assesses that assertion. What constitutes a sufficient legitimate interest is not harmonised across member states. Some registers accept a written declaration. Others require supporting documentation. A few require a formal application with a decision timeline measured in weeks.
| Register type | Typical GDPR basis | Third-party access | Post-C-37/20 restriction |
|---|---|---|---|
| Commercial register (directors, share capital) | Art. 6(1)(c) — legal obligation | Generally open | Not directly affected |
| Shareholder list (private company) | Art. 6(1)(c) or (e) | Varies by jurisdiction | Varies |
| UBO / beneficial ownership register | Art. 6(1)(c) + AML directive | Legitimate interest required | Yes — applies across EU |
| Insolvency register | Art. 6(1)(e) — public task | Restricted; purpose-linked | Partial |
| Court register (enforcement, charges) | Art. 6(1)(e) | Restricted; varies | Partial |
A legitimate interest claim is not self-executing. The register — or the competent authority — applies a three-part test drawn from GDPR recital 47 and national implementation: the interest must be legitimate, necessary, and not overridden by the data subject's fundamental rights.
For a cross-border buyer verifying an ownership structure, the interest is typically framed as due diligence prior to a transaction or investment. That framing is accepted in most EU jurisdictions. However, the documentation required to support it differs. Some registers accept a one-line declaration on a standard form. Others require evidence of the transaction — a letter of intent, a mandate, or a notarised statement.
The assessment is made by the register, not by the applicant. A rejected application does not produce the data. It produces a refusal, sometimes with a right of appeal, sometimes without. The timeline for that process is not standardised.
Outside the EU, the concept of legitimate interest as a formal access condition is less common. Common-law jurisdictions — including the United Kingdom post-Brexit — retain their own data protection frameworks. The UK GDPR mirrors the EU text but is administered independently. Access conditions to Companies House data are not subject to a legitimate interest gate for the standard register; the PSC register (persons with significant control) is publicly accessible without a stated basis.
The angle of control — who actually directs the company and what a shareholder can enforce — requires data from multiple register layers. Each layer may sit under a different legal basis.
The registered director layer is typically open. The shareholder layer may be open or restricted depending on whether the company is public or private and on the jurisdiction's implementation of transparency obligations. The beneficial owner layer is the most restricted and the most variable.
A structural analysis that stops at the director layer is incomplete. A structural analysis that reaches the beneficial owner layer requires navigating the legitimate interest gate in each relevant jurisdiction. That navigation is not uniform. It is a sequence of jurisdiction-specific procedural steps, each with its own timeline and its own risk of refusal.
The data protection basis is therefore not a background compliance matter. It is a determinant of what the analysis can establish and how long it takes to establish it.
The ceiling of what the sources allow is stated before payment.
No register in any jurisdiction discloses more than its founding legislation requires. The data protection basis sets the outer boundary; the register's operational practice sets the working boundary, which is often narrower.
For UBO data in EU member states, the outer boundary shifted in November 2022. Registers that were previously open without condition are now gated. The working boundary — how each member state implements the legitimate interest requirement — has not converged. Some member states have published guidance. Others have not. The gap between the legal text and the operational practice is, in several jurisdictions, unresolved.
For shareholder data in private companies outside mandatory disclosure regimes, the outer boundary is the register's founding statute. Where that statute does not require disclosure of individual shareholders, the register does not hold the data in accessible form. No data protection analysis changes that: the absence of a legal obligation to collect is prior to any question of basis for disclosure.
For court and enforcement data, access is purpose-linked. A party without a demonstrated connection to the proceeding may be refused. The refusal is not a data protection violation; it is the correct operation of the access regime.
What a structural analysis can establish, therefore, depends on three variables: the jurisdiction, the register layer, and the applicant's ability to satisfy the access condition for that layer. The analysis names each variable and states where the chain ends and why.
Divergence between register layers is itself a finding. A director named in the commercial register who does not appear in the UBO register — or whose ownership percentage differs between the two — is a discrepancy that the analysis records and reports. The data protection basis for each layer may explain why the data differs: different collection obligations, different update frequencies, different verification standards.
The commercial register typically reflects filed documents. The UBO register reflects declarations. Neither is independently verified in most jurisdictions. A declaration of beneficial ownership is not audited at the point of filing. Discrepancies between declared and actual control structures are not detectable from register data alone.
The analysis states what each source shows, where the sources diverge, and where the divergence cannot be resolved from official data.
Does GDPR apply to company ownership data? GDPR applies where the data relates to an identified or identifiable natural person. Ownership data for companies with natural-person shareholders or beneficial owners falls within scope. Data relating solely to legal entities does not. In practice, most ownership structures involve natural persons at some level of the chain, so GDPR is relevant to most cross-border ownership analyses.
What is a legitimate interest for UBO register access? Following CJEU C-37/20, EU member states require applicants to demonstrate a legitimate interest before accessing UBO register data. The concept is not defined uniformly. Due diligence prior to a transaction or investment is the most commonly accepted framing. The register — or the competent authority — assesses the claim. Acceptance is not guaranteed, and the assessment timeline varies by jurisdiction.
Does the UK PSC register require a legitimate interest claim? No. The PSC register at Companies House is publicly accessible without a stated basis. Post-Brexit, the UK GDPR applies to UK data controllers but does not impose a legitimate interest gate on standard Companies House access. This position is subject to legislative change and should be verified against current Companies House guidance.
Can a refusal of UBO access be appealed? In some jurisdictions, yes. The right of appeal, the competent body, and the timeline differ by member state. A refusal is not a final answer in all cases, but pursuing an appeal extends the timeline of the analysis.
What happens when the register does not hold the data? Where a jurisdiction's founding statute does not require collection of a particular data point — individual shareholders in a private company, for example — the register does not hold the data in accessible form. No data protection analysis and no access procedure changes that. The analysis records the absence and identifies the register layer at which the chain ends.
Sources:
GDPR (Regulation (EU) 2016/679) — https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679 — verified 2026-09-01
CJEU Judgment in Cases C-37/20 and C-601/20 (WM and Sovim SA v Luxembourg Business Registers) — https://curia.europa.eu — verified 2026-09-01
Companies House (UK) — PSC register — https://www.gov.uk/government/organisations/companies-house — verified 2026-09-01
Disclaimer: This report is a factual compilation from official registers and public sources. It is provided for informational purposes only, does not constitute legal advice, and contains no legal qualification of the facts established. VLO Law Firm assumes no liability for actions taken or not taken based on this material. For advice regarding your particular situation, please contact info@vlolawfirm.com.
Author: Katharina Berg — Partner, Central Europe, VLO Law Firm