PayPal & the General Data Protection Regulation (GDPR)

What is the GDPR?

The General Data Protection Regulation (GDPR) is designed to strengthen controls that individuals have over their personal data and their right to privacy. It requires greater controls by companies that collect and process personal data.

Any organization holding personal data, including smaller businesses and charities, is subject to the GDPR if it is located in Europe or offering goods or services to individuals in Europe. Personal data refers to particular information that directly or indirectly identifies a person.

What is PayPal doing to address the GDPR?

PayPal continuously focuses on how we protect our customer, employee, partner and merchant data. The GDPR is considered a fundamental shift in privacy and data protection and will help drive a stronger baseline of requirements for personal data of individuals in Europe.

PayPal has an established Global Privacy Program and Framework and a dedicated team of privacy professionals committed to ensuring that PayPal is ready for the various privacy regulations across the globe, including the GDPR. Some of the key enhancements of our Global Privacy Program include:

• Updates to our User Agreement and Privacy Statement as well as our internal policies and procedures.
• Providing additional ways for customers to manage their preferences in relation to the processing of their personal data, e.g. marketing opt-outs. For more information, please visit the ‘PayPal and Your Data’ personal or business account pages.
• Continuing to support and commit to privacy and data protection after 25 May 2018, by reassessing and improving our GDPR capabilities through strategic initiatives and considering any regulatory changes along the way.

PayPal as a data controller or data processor.

The GDPR provides businesses that are handling personal data with different roles. The data controller, alone or jointly with others, determines the purposes and means for processing personal data, while the data processor is processing data on behalf of the data controller.

PayPal is either a data controller or data processor, depending on the PayPal product or service that is being offered to the PayPal customer.

Both the data controller and data processor are required to protect personal data according to the GDPR. For data processors, those obligations should be clearly determined by the various parties with data protection terms in their agreements to make sure that customers’ personal data is lawfully processed.

We regularly review our terms and conditions and assess our data practices to ensure they are kept up to date with the latest regulatory changes.

Read our Privacy Statement

Learn about PayPal and your data

Read our PayPal GDPR story blog