GDPR checklist for payments tools.
Payment providers handle customer billing details, and many also decide their own purposes such as fraud prevention. Compare 22 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 Stripe | Depends on the activity | Set per account or project | Published by the vendor |
 Paddle | Depends on the activity | Set per account or project | Published by the vendor |
 Lemon Squeezy | Depends on the activity | Set per account or project | Published by the vendor |
 PayPal | Depends on the activity | Set per account or project | Published by the vendor |
 Square | Depends on the activity | Set per account or project | Published by the vendor |
 Mollie | Depends on the activity | Set per account or project | Obtained through the vendor |
 Checkout.com | Depends on the activity | Set per account or project | Published by the vendor |
 Braintree | Depends on the activity | Set per account or project | Published by the vendor |
 GoCardless | Depends on the activity | Set per account or project | Obtained through the vendor |
 Payoneer | Depends on the activity | Set per account or project | Published by the vendor |
 Recurly | Usually a processor | Set per account or project | Obtained through the vendor |
 Chargebee | Usually a processor | Set per account or project | Published by the vendor |
 Zuora | Usually a processor | Set per account or project | Published by the vendor |
 FastSpring | Depends on the activity | Set per account or project | Published by the vendor |
 Worldline | Depends on the activity | Often Belgium, check your account | Published by the vendor |
 Polar | Depends on the activity | Set per account or project | Published by the vendor |
 Creem | Depends on the activity | Set per account or project | Published by the vendor |
 Dodo Payments | Depends on the activity | Set per account or project | Published by the vendor |
 Maxio | Usually a processor | Set per account or project | Published by the vendor |
 Tink | Depends on the activity | Set per account or project | Obtained through the vendor |
 Authorize.net | Usually a processor | Set per account or project | Published by the vendor |
 Paysafe | Depends on the activity | Set per account or project | Published by the vendor |
What to check for payments tools
- Work out whether the provider acts as your processor, as an independent controller, or as both for different activities.
- Say in your privacy policy that payment data is handled by the provider and for what purpose.
- Record the provider as a recipient of customer names, emails and transaction data.
- Check retention rules the provider applies for legal and fraud reasons.
All payments tools
- StripePayments
- PaddlePayments
- Lemon SqueezyPayments
- PayPalPayments
- SquarePayments
- MolliePayments
- Checkout.comPayments
- BraintreePayments
- GoCardlessPayments
- PayoneerPayments
- RecurlyPayments
- ChargebeePayments
- ZuoraPayments
- FastSpringPayments
- WorldlinePayments
- PolarPayments
- CreemPayments
- Dodo PaymentsPayments
- MaxioPayments
- TinkPayments
- Authorize.netPayments
- PaysafePayments
Questions, answered.
What should I check before using a payments tool under the GDPR?
Work out whether the provider acts as your processor, as an independent controller, or as both for different activities. Say in your privacy policy that payment data is handled by the provider and for what purpose. Record the provider as a recipient of customer names, emails and transaction data. Check retention rules the provider applies for legal and fraud reasons.
Do I need a data processing agreement with a payments provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which payments tools does Privacyboard cover?
Stripe, Paddle, Lemon Squeezy, PayPal, Square, Mollie, Checkout.com, Braintree, GoCardless, Payoneer, Recurly, Chargebee, Zuora, FastSpring, Worldline, Polar, Creem, Dodo Payments, Maxio, Tink, Authorize.net, Paysafe. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.