The document lists third-party entities and Stripe affiliates by name, country of establishment, and processing purpose to which personal data may be transferred when Stripe provides its payment, fraud, infrastructure, analytics, and support services.
This analysis describes what Stripe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the disclosure required under GDPR Article 28 for merchant organizations operating as data controllers, enabling those organizations to maintain accurate records of processing activities and to evaluate whether sub-processor arrangements satisfy their own compliance obligations.
Interpretive note: The document does not reproduce verbatim clause text in a traditional contractual format; the disclosure is structured as a reference list rather than a contract provision, and the precise notification and objection mechanisms are governed by the separately executed DPA.
The document establishes that personal data processed through Stripe services may be accessed by a defined set of named third parties and Stripe affiliates, each associated with a stated processing purpose and country of establishment.
Cross-platform context
See how other platforms handle Sub-Processor Disclosure and Enumeration and similar clauses.
Compare across platforms →Monitoring
Stripe has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
REGULATORY LANDSCAPE: This provision directly implements GDPR Article 28(2) and (3), which require that processors only engage sub-processors under binding contracts and disclose those arrangements to controllers. Equivalent obligations apply under UK GDPR. The relevant enforcement authority for Stripe's EU operations is the Irish Data Protection Commission. Where sub-processors are located outside the EEA, transfer mechanism obligations under GDPR Chapter V and UK GDPR apply. GOVERNANCE EXPOSURE: Medium. The provision discloses sub-processors but does not specify the update cadence or the mechanism by which merchants are notified of additions. Merchant organizations that have executed a DPA with Stripe must independently monitor the list for changes in order to exercise timely objection rights, and the absence of a stated notification timeline creates an operational compliance gap. JURISDICTION FLAGS: EU/EEA and UK organizations face the highest compliance exposure, as GDPR and UK GDPR impose affirmative obligations on controllers to verify sub-processor arrangements. Organizations in Switzerland face comparable obligations under the revised Federal Act on Data Protection. Non-EEA merchants may face lower direct regulatory exposure but should evaluate whether their own applicable law imposes equivalent requirements. CONTRACT AND VENDOR IMPLICATIONS: Merchant procurement and legal teams should verify that their executed DPA with Stripe explicitly grants the right to object to new sub-processor additions and specifies an objection window. The document cross-references Stripe's DPA and Data Transfer Addendum as the instruments governing sub-processor obligations, but does not independently establish those rights. COMPLIANCE CONSIDERATIONS: Compliance teams should incorporate this list into Records of Processing Activities documentation. Data mapping exercises should be updated to trace data flows to each listed sub-processor. Teams should establish a review schedule aligned with Stripe's sub-processor list update frequency, and should confirm that the transfer mechanisms cited in Stripe's Data Transfer Addendum cover all non-EEA sub-processors listed.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 3 platforms + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes the disclosure required under GDPR Article 28 for merchant organizations operating as data controllers, enabling those organizations to maintain accurate records of processing activities and to evaluate whether sub-processor arrangements satisfy their own compliance obligations.
The document establishes that personal data processed through Stripe services may be accessed by a defined set of named third parties and Stripe affiliates, each associated with a stated processing purpose and country of establishment.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Stripe.