New EMEA and APAC Data Controller Designation (Stripe Technology Company Limited)

What it is

The document designates Stripe Technology Company Limited, an Irish entity, as a new data controller with primary responsibility for processing personal data outside of the Americas. This designation applies to EMEA and APAC regions.

Why it matters (compliance & governance perspective)

The introduction of a new data controller entity may alter the legal basis and accountability structure governing personal data processing for Business Users and their End Customers in EMEA and APAC. Business Users who have documented Stripe's controller identity in their own privacy notices, DPAs, or Article 30 records may need to update those references.

Consumer impact (what this means for users)

Under the updated terms, Stripe Technology Company Limited replaces or supplements prior controller entities for personal data processed in EMEA and APAC regions. Business Users in these regions may need to update their own privacy documentation and data processing agreements to reflect the new controller identity.

Institutional analysis (regulatory & governance intelligence)

1. REGULATORY LANDSCAPE: This designation engages GDPR Articles 4(7) and 24, which define data controller responsibilities and accountability obligations. The Irish Data Protection Commission is the likely lead supervisory authority for Stripe Technology Company Limited as an Irish-registered entity. Business Users subject to GDPR should evaluate whether this controller change requires updates to their own Records of Processing Activities and any joint controller or controller-processor agreements referencing prior Stripe entities. 2. GOVERNANCE EXPOSURE: Medium. The designation of a new controller entity may create gaps in existing contractual and compliance documentation if Business Users' DPAs or privacy notices reference Stripe, Inc. or Stripe Payments Europe Limited as the sole controller. Teams should confirm that the new entity is reflected in any Standard Contractual Clauses or other transfer mechanisms in use. 3. JURISDICTION FLAGS: Heightened exposure for Business Users in EU, EEA, UK, and APAC jurisdictions where data protection law requires identification of the specific controller entity. UK GDPR, Swiss FADP, and APAC frameworks including Singapore's PDPA and Australia's Privacy Act each impose controller identification obligations that may be affected by this change. 4. CONTRACT AND VENDOR IMPLICATIONS: Business Users who have executed Stripe's DPA referencing specific Stripe controller entities should confirm whether the addition of Stripe Technology Company Limited requires a DPA amendment or addendum. Existing Standard Contractual Clauses may need to be re-executed or updated to name the new controller entity where cross-border data transfers are involved. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should update Article 30 records to reflect Stripe Technology Company Limited as a controller for EMEA and APAC data processing, review existing privacy notices to confirm controller identification is accurate, and assess whether any regulatory notification obligations are triggered by a change in controller identity under applicable national law.

Applicable agencies

Provision details

Other risks in this policy

• Google Processes User Data For Multiple Services medium
• Microsoft AI Improves Quality Of User Support medium
• 30-Day Written Objection Right For New Sub-Processor high
• Amazon India Stores Indian Payment Transaction Data high
• Deemed Acceptance After 30-Day Objection Period high
• Ekata Service Provider Provides Sanctions Screening high