The General Data Protection Regulation (GDPR) is designed to strengthen the control that individuals have over their personal data and their right to privacy. It requires greater controls by companies that collect and process personal data.
Any organisation holding personal data, including smaller businesses and charities, is subject to the GDPR if it is located in Europe or offering goods or services to individuals in Europe. Personal data refers to particular information that directly or indirectly identifies a person.
PayPal continuously focuses on how we protect our customer, employee, partner and merchant data. The GDPR is considered a fundamental shift in privacy and data protection and will help drive a stronger baseline of requirements for personal data of individuals in Europe.
PayPal has an established Global Privacy Programme and Framework and a dedicated team of privacy professionals committed to ensuring that PayPal is ready for the various privacy regulations across the globe, including the GDPR. Some of the key enhancements of our Global Privacy Programme include:
The GDPR provides businesses that are handling personal data with different roles. The data controller, alone or jointly with others, determines the purposes and means for processing personal data, while the data processor is processing data on behalf of the data controller.
PayPal is either a data controller or data processor, depending on the PayPal product or service that is being offered to the PayPal customer.
Both the data controller and data processor are required to protect personal data according to the GDPR. For data processors, those obligations should be clearly determined by the various parties with data protection terms in their agreements to make sure that customers’ personal data is lawfully processed.
We regularly review our terms and conditions and assess our data practices to ensure they are kept up to date with the latest regulatory changes.
Read our privacy statement
Learn about PayPal and your data
Read our PayPal GDPR story blog