GDPR Compliance Guide for Payment Processors

Payment processors are the backbone of online commerce — and a significant GDPR compliance nexus. For non-EU businesses, understanding how payment processors handle EU customer data is essential for avoiding regulatory gaps.

Payment Processors as Data Processors

Stripe, PayPal, Square, Paddle, Adyen, Mollie — these are data processors under Article 4(8). You, the merchant, are the data controller. This means: you need a DPA with each processor, your ROPA must document the data flows, and Article 27 requires you — not the processor — to appoint an EU Representative.

Data Processed by Payment Processors

Payment processors collect and process: cardholder name, billing address, shipping address (sometimes), email, IP address, payment instrument details (PAN, expiry), transaction amount, currency, and transaction timestamp. All of this is personal data under Article 4(1). For SEPA direct debit: IBAN, account holder name, mandate reference — also personal data.

Stripe-Specific Considerations

Stripe processes data globally. For EU customers, Stripe provides: Stripe’s DPA (comprehensive, GDPR-ready), EU data storage options (Ireland, Frankfurt), Stripe Radar and machine learning analysis of EU transaction data (automated decision-making under Article 22). Verify your Stripe processing location and include Stripe data flows in your ROPA.

PayPal-Specific

PayPal is a data controller for the PayPal account data (name, email, address you collect in your checkout flow) but PayPal receives minimal merchant-side data for payment processing. Your DPA with PayPal covers this. Verify PayPal’s data processing location.

PCI DSS vs GDPR

PCI DSS security requirements (cardholder data encryption, access controls) complement GDPR’s Article 32 security obligations. PCI compliance does not satisfy GDPR — the frameworks serve different purposes. You need both.

Compliance Steps

1. Appoint EU Shield as your EU Representative
2. Sign DPAs with all payment processors
3. Document processor data flows in your ROPA
4. Update Privacy Policy with processor details and EU Rep contact
5. Verify processor EU data storage locations

Get started →