Legitimate Interests as Legal Basis for Processing

What it is

The policy states that Stripe relies on legitimate interests as one of its legal bases for processing personal data, with the specific basis for each processing activity disclosed in the Privacy Center.

Why it matters (compliance & governance perspective)

Reliance on legitimate interests as a processing basis under GDPR requires a balancing test against data subject rights and interests; the policy directs users to the Privacy Center for specifics, meaning the legal basis documentation is distributed across multiple documents rather than consolidated in this policy.

Consumer impact (what this means for users)

Under this provision, certain processing activities including fraud detection, security, and marketing communications may proceed on the basis of Stripe's asserted legitimate interests, subject to data subjects' right to object to such processing under GDPR Article 21.

What you can do

Institutional analysis (Compliance & governance intelligence)

1. REGULATORY LANDSCAPE: GDPR Article 6(1)(f) permits processing based on legitimate interests after a balancing test demonstrating that Stripe's interests are not overridden by the data subject's fundamental rights. EU data protection authorities have issued guidance indicating that reliance on legitimate interests requires documented balancing assessments for each processing purpose. Data subjects retain the right to object under GDPR Article 21, and Stripe must cease processing unless it can demonstrate compelling legitimate grounds. 2. GOVERNANCE EXPOSURE: Medium. Broad reliance on legitimate interests across multiple processing categories without explicit enumeration in the main policy document may complicate demonstrating GDPR Article 6 compliance to regulators and data subjects. The distribution of legal basis information across the main policy and a separate Privacy Center creates a layered disclosure structure that requires users to navigate multiple documents to understand the complete legal basis framework. 3. JURISDICTION FLAGS: EU and EEA data subjects have a right to object to processing based on legitimate interests at any time under GDPR Article 21, requiring Stripe to cease unless compelling grounds are demonstrated. UK GDPR mirrors this requirement. Legitimate interests as a basis is not available for sensitive data categories under GDPR Article 9. California law does not recognize a direct equivalent, though the CCPA's opt-out rights serve a related function for certain categories of sharing. 4. CONTRACT AND VENDOR IMPLICATIONS: Organizations acting as data controllers who share data with Stripe should assess whether Stripe's reliance on legitimate interests for its own controller processing is compatible with the purposes for which the organization originally collected that data. Purpose compatibility analysis may be required under GDPR Article 6(4). 5. COMPLIANCE CONSIDERATIONS: Compliance teams should review Stripe's Privacy Center to identify the specific legitimate interests relied upon for each processing activity and assess whether those bases would withstand regulatory scrutiny in the jurisdictions where their customers are located. The right to object to legitimate interests processing should be documented and communicated to data subjects in the organization's own privacy notices.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Collection of Data from Non-Account Holders medium
• Fraud Prevention Network Data Sharing medium
• Biometric Data Collection high
• Advertising and Analytics Partner Data Sharing medium
• Cross-Border Data Transfers and Data Privacy Framework medium
• Government-Issued Identity Data Collection high