Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy discloses that Stripe transfers personal data internationally and relies on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses as transfer mechanisms for data flows from the EU, UK, and other jurisdictions to the United States.
This analysis describes what Stripe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the legal mechanisms Stripe relies upon for cross-border data transfers, which are subject to ongoing regulatory review and potential challenge; organizations processing EU or UK personal data through Stripe must confirm these mechanisms remain current and adequate under applicable law.
Interpretive note: The precise scope of Standard Contractual Clauses executed and the specific data flows covered by each transfer mechanism are detailed in the Data Processing Agreement and Data Transfer Addendum, which are separate documents not fully reproduced here.
Under this provision, personal data of EU, UK, and other non-U.S. users may be transferred to the United States and other countries under Standard Contractual Clauses or the Data Privacy Framework, with the applicable legal mechanism depending on the specific data flow and processing activity.
How other platforms handle this
In certain circumstances, the right to data portability, which means that you can request that we provide certain Personal Data we hold about you in a machine-readable format
If you want to see what information we have collected about you, you can request a copy of your data in the Data & Privacy section of your User Settings. You should receive your data packet within 30 days.
For data portability requests, We will select a format to provide Your personal information that is readily useable and should allow You to transmit the information from one entity to another entity without hindrance.
Monitoring
Stripe has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"For more details about our privacy practices, including our role, the specific Stripe entity responsible under this Policy, and our legal bases for processing your Personal Data, please visit our Privacy Center.Excerpt from Stripe's Privacy Policy
1. REGULATORY LANDSCAPE: Cross-border data transfers from the EU engage GDPR Chapter V, which restricts transfers to third countries without an adequacy decision, Standard Contractual Clauses, or other approved mechanisms. The EU-U.S. Data Privacy Framework was adopted in 2023 but remains subject to legal challenge, and its continued validity is not certain. The UK has its own international data transfer regime following Brexit. Stripe references its Data Transfer Addendum and Supplier Data Transfers Addendum as supplementary instruments. 2. GOVERNANCE EXPOSURE: Medium. Organizations relying on Stripe's Data Privacy Framework participation and Standard Contractual Clauses as their own transfer mechanism justification face exposure if those mechanisms are successfully challenged or invalidated. The European Data Protection Board and national data protection authorities actively scrutinize U.S. transfer arrangements. 3. JURISDICTION FLAGS: EU and EEA data subjects have direct GDPR rights regarding transfers to third countries. UK data subjects are governed by UK GDPR and the UK's International Data Transfer Agreement mechanism. Swiss data subjects are covered by the Swiss-U.S. Data Privacy Framework. Organizations in these jurisdictions should maintain current transfer impact assessments. 4. CONTRACT AND VENDOR IMPLICATIONS: Organizations relying on Stripe as a processor for EU personal data should confirm execution of Stripe's Data Processing Agreement and applicable Standard Contractual Clauses. The Data Transfer Addendum available at stripe.com/legal/dta should be reviewed and executed where applicable. Ongoing monitoring of the Data Privacy Framework's legal status is warranted given its litigation history. 5. COMPLIANCE CONSIDERATIONS: Legal teams should maintain transfer impact assessments documenting the adequacy of Stripe's transfer mechanisms for their specific data flows. Any change in the legal status of the EU-U.S. Data Privacy Framework would require prompt reassessment of transfer mechanisms and potential contractual amendments. Organizations subject to sector-specific data localization requirements should confirm Stripe's transfer practices are compatible.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes the legal mechanisms Stripe relies upon for cross-border data transfers, which are subject to ongoing regulatory review and potential challenge; organizations processing EU or UK personal data through Stripe must confirm these mechanisms remain current and adequate under applicable law.
Under this provision, personal data of EU, UK, and other non-U.S. users may be transferred to the United States and other countries under Standard Contractual Clauses or the Data Privacy Framework, with the applicable legal mechanism depending on the specific data flow and processing activity.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Stripe.