When financial firms share data with external vendors (e.g., payment platforms, auditors), they are responsible for GDPR compliance. Written contracts must bind processors to comparable standards of confidentiality, security, breach handling processes, and data return or deletion.
