.svg)
.svg)
.svg)
.svg)
.svg)
The unified orchestration layer for wallets and alternative payments
.svg)
The secure repository for all your payment methods
.svg)
Workflow-driven payments intelligence for smarter routing and higher auth rates
.svg)
A flexible fraud and authentication layer. Instantly add advanced fraud tools and 3DS
One integration to sell inside ChatGPT, Gemini, and every agentic platform
The visual workflow builder that ties fraud, identity, and payment routing together in one place
The unified orchestration layer for wallets and alternative payments
The secure repository for all your payment methods
Workflow-driven payments intelligence for smarter routing and higher auth rates
A flexible fraud and authentication layer. Instantly add advanced fraud tools and 3DS
One integration to sell inside ChatGPT, Gemini, and every agentic platform
The visual workflow builder that ties fraud, identity, and payment routing together in one place
GDPR (General Data Protection Regulation)
The General Data Protection Regulation (GDPR) is the European Union's comprehensive data protection law, which came into force in May 2018 and applies to any organization that processes the personal data of individuals located in the EU, regardless of where the organization itself is based. In payments, GDPR governs how cardholder data (which qualifies as personal data), transaction records, and other customer data must be handled.
GDPR establishes several key principles for personal data processing: data must be collected for specified, explicit, and legitimate purposes; it must be adequate, relevant, and limited to what is necessary; it must be accurate and kept up to date; it must not be retained longer than necessary; it must be processed securely; and the controller must be able to demonstrate compliance. These principles apply to payment data alongside other customer data.
GDPR grants individuals specific rights over their data: the right to access their data, the right to correct inaccurate data, the right to erasure ("right to be forgotten"), the right to restrict processing, the right to data portability (receiving their data in a machine-readable format), and the right to object to certain types of processing. For payments businesses, the right to erasure and data portability create operational challenges when payment records must be retained for legal or compliance purposes.
GDPR intersects with PCI DSS in payment contexts. Both require strong security for cardholder data, but they operate under different frameworks with different enforcement mechanisms. PCI DSS is a contractual standard enforced by card networks; GDPR is a legal regulation enforced by data protection authorities with fines of up to 4% of global annual turnover for serious violations.
Frequently Asked Questions
Does GDPR apply to non-EU businesses processing EU customer data?
Yes. GDPR has explicit extraterritorial reach, it applies to any organization that processes the personal data of EU residents, regardless of the organization's location. A US-based payments company that processes transactions for EU cardholders is subject to GDPR in respect of that data.
How does GDPR's "right to erasure" interact with payment record retention requirements?
GDPR's right to erasure (Article 17) allows individuals to request the deletion of their personal data, but it is not absolute, it does not apply when data processing is necessary for compliance with a legal obligation. Payment businesses are required by tax law, AML regulations, and card network rules to retain transaction records for defined periods (typically five to seven years depending on jurisdiction). During those retention periods, the right to erasure can be declined on legal compliance grounds.
Does GDPR require consent for processing payment data?
Not necessarily, consent is just one of six legal bases for processing personal data under GDPR. Payment data processed for the performance of a contract (completing a purchase the customer initiated) typically relies on the "contract performance" legal basis rather than consent. Consent is most relevant for marketing, analytics, and optional data uses, not for the core processing of payment data necessary to complete a transaction.
Related Terms
