Director and ubo: What data protection basis applies

The question of who controls a company runs through two distinct legal layers. The first is corporate law: who is registered, who holds shares, who signs. The second is data protection law: on what legal basis does a register hold and publish that person's data — and what does that basis permit a third party to obtain.

Both layers govern what an international buyer can establish before a transaction closes. The angle here is control: who actually controls the company, and what the shareholder or counterparty can enforce. Data protection law is not an obstacle to that inquiry. It is the framework that determines which facts are accessible, on what conditions, and where the chain stops.

The legal basis that governs director data in commercial registers

Director data — name, date of birth in some jurisdictions, registered address, appointment and resignation dates — is processed by commercial registers under one of two GDPR bases: legal obligation (Article 6(1)(c)) or public interest (Article 6(1)(e)).

The distinction matters for control analysis. A legal-obligation basis means the register is required by statute to hold and publish the data. A public-interest basis means the register may do so, subject to proportionality review. In practice, most EU commercial registers operate under legal obligation: the company law directive or its national implementing act mandates registration and publication.

Third-party access to that data — by a buyer, a counterparty, or an analyst — is not a separate processing operation requiring its own basis. The register's basis covers disclosure to the public where the register is designated as public. What changes after CJEU C-37/20 is not director data: it is UBO data, which sits in a separate register with a separate legal basis.

The ceiling of what the sources allow is stated before payment.

The legal basis that governs UBO data

Beneficial ownership registers were established across the EU under the Fourth and Fifth Anti-Money Laundering Directives. The legal basis for processing UBO data is legal obligation under Article 6(1)(c) GDPR, combined with Article 9 processing conditions where the data touches sensitive categories.

The CJEU ruling of November 2022 (joined cases C-37/20 and C-601/20) held that unrestricted public access to UBO registers is incompatible with the Charter of Fundamental Rights. Member states responded at different speeds and with different access regimes. The result is a fragmented landscape across 35 jurisdictions:

• Some member states require a written request with a statement of legitimate interest.
• Some require professional credentials (lawyer, notary, journalist).
• Some have suspended public access pending legislative amendment.
• Non-EU jurisdictions operate under their own frameworks entirely.

The UK's PSC (Persons with Significant Control) register at Companies House remains publicly accessible. Poland's CRBR operates under a regime that requires verification before publication. Both should be confirmed with a local consultant before any SKU relying on beneficial owner data is opened.

What "legitimate interest" means in practice for a buyer

A buyer conducting pre-acquisition due diligence has a recognised basis for requesting UBO data in most jurisdictions that have implemented a legitimate-interest access regime. The basis is not automatic: it requires a documented request, identification of the specific company, and in some jurisdictions a declaration of the purpose.

What this means for control analysis:

• The chain from registered director to ultimate beneficial owner can be traced, but the method differs by jurisdiction.
• In jurisdictions where the UBO register is closed to general access, the chain is established through filed documents: shareholder lists, articles of association, notarial deeds, and cross-border group structure filings.
• Where the chain cannot be completed from official sources, the report states the level at which it stops and the reason.

The ceiling of what the sources allow is stated before payment. No report issued by VLO Law Firm asserts beneficial ownership beyond what official sources confirm.

Where the data protection basis intersects with shareholder rights

A shareholder's right to inspect the register of members is a corporate law right, not a data protection right. It exists independently of GDPR. In most jurisdictions, a registered shareholder can inspect the register of members and obtain a certified copy.

The data protection basis for that register — typically legal obligation under company law — means the company cannot refuse inspection on data protection grounds alone. GDPR does not override the corporate law right; it governs how the data is held and what security measures apply.

For a buyer who is not yet a shareholder, the position is different. Pre-acquisition access to the register of members depends on the company's cooperation or on the jurisdiction's disclosure rules for target companies. Official registers show what has been filed. What has not been filed — or what has been filed incorrectly — is a gap that the report identifies but cannot close.

What is included at each tier

The scope and price of a report on director and UBO data protection basis are communicated in response to a request. The scope depends on the number of jurisdictions, the depth of the ownership chain, and the access conditions applicable at the time of the request.

The limit of what the sources allow

Official registers show what has been filed. They do not show:

• Whether the filed information is accurate at the date of the report.
• Whether a nominee director arrangement exists behind the registered name.
• Whether the UBO declaration matches the actual economic interest.
• Whether a trust or foundation sits above the registered shareholder.

In EU jurisdictions where UBO register access requires a legitimate-interest declaration, the register shows the declared beneficial owner. It does not verify that declaration against underlying documents.

In jurisdictions outside the EU, beneficial ownership disclosure requirements vary from full public disclosure to no statutory requirement at all. Where no requirement exists, the chain is traced through filed corporate documents. Where those documents are not filed or not public, the report states the level at which the chain stops.

The data protection basis applied by a register determines what a third party can obtain. It does not determine what is true. Those are different questions, and the report distinguishes them.

Where the sources disagree

The most common disagreement is between the UBO register and the shareholder list filed with the commercial register. A shareholder list shows registered holders. A UBO declaration shows the declared beneficial owner. Where these differ — different names, different percentage thresholds, different dates — the discrepancy is itself a finding.

A second common disagreement is between the data protection basis stated in the register's own documentation and the access regime actually applied at the counter. Some registers state public access in their legislation but apply a legitimate-interest filter in practice. The report records both.

FAQ

Does GDPR prevent a buyer from obtaining director and UBO data before a transaction? GDPR does not prevent access to data held in public registers on a legal-obligation or public-interest basis. It restricts access to UBO registers following the CJEU 2022 ruling. A buyer with a documented legitimate interest can request UBO data in most EU jurisdictions through the applicable access procedure.

Is the PSC register in the UK still publicly accessible after Brexit? Yes. Companies House PSC data remains publicly accessible under the UK's post-Brexit regime. The access conditions and the scope of required disclosure should be confirmed with a local consultant before reliance.

What happens when the UBO register shows no entry? An absent entry can mean the company has no registrable beneficial owner above the threshold, the declaration has not been filed, or the register has not yet processed the filing. The report distinguishes between these possibilities where the source data permits.

Can a company refuse to disclose its shareholder register on data protection grounds? In most jurisdictions, a registered shareholder's right to inspect the register of members is a statutory corporate law right. A company cannot refuse that right on data protection grounds alone. Pre-acquisition access by a non-shareholder depends on the jurisdiction's rules and the company's cooperation.

What is the threshold for UBO registration in EU member states? The standard threshold under the AMLD framework is 25% of shares, voting rights, or ownership interest. Some member states apply lower thresholds or additional criteria. The applicable threshold in a specific jurisdiction is identified in the report for that jurisdiction.

Sources:

• CJEU, joined cases C-37/20 and C-601/20 — curia.europa.eu — verified 2026-09-10
• Companies House PSC register — find-and-update.company-information.service.gov.uk — verified 2026-09-20
• European Commission, Anti-Money Laundering Directives (4AMLD, 5AMLD, 6AMLD) — ec.europa.eu — verified 2026-09-15
• Regulation (EU) 2016/679 (GDPR), Articles 6, 9 — eur-lex.europa.eu — verified 2026-09-15

Request this report

Request this report

Disclaimer: This report is a factual compilation from official registers and public sources. It is provided for informational purposes only, does not constitute legal advice, and contains no legal qualification of the facts established. VLO Law Firm assumes no liability for actions taken or not taken based on this material. For advice regarding your particular situation, please contact info@vlolawfirm.com.

Author: Katharina Berg — Partner, Central Europe, VLO Law Firm