The GDPR governs the processing of identifiable people's data across the full information lifecycle. A controller determines why and how data is used; a processor acts on the controller's instructions. The regulation can also reach organisations outside the EU when they offer goods or services to people in the EU or monitor their behaviour. A payment transaction can involve several controllers and processors, so responsibility follows the actual processing role.

Processing needs a lawful basis, such as contractual necessity, legal obligation, legitimate interests or consent where appropriate. Consent is not the default answer to every activity. Purpose limitation, data minimisation, accuracy, retention limits and security constrain how information is collected and reused. Special-category data receives additional protection. Privacy notices explain the processing, while access, correction, erasure, restriction, portability and objection rights give individuals different forms of control, subject to their legal conditions.

Accountability connects those principles to documented decisions, processor agreements, appropriate technical and organisational safeguards, and privacy by design and default. High-risk processing can require a data-protection impact assessment; certain organisations must appoint a data-protection officer. A controller generally notifies a qualifying personal-data breach to the supervisory authority within 72 hours of awareness, and communicates high-risk breaches to affected people under the relevant conditions. International transfers need a permitted transfer mechanism as well as a lawful basis for the underlying processing.

For payments, this means distinguishing data needed to execute a transfer, prevent fraud, satisfy record-keeping law and conduct optional marketing. These purposes can have different legal bases and retention periods. The GDPR does not require deletion of records that another applicable law requires an organisation to retain, nor does a payment-service contract authorise unrelated secondary uses of customer information.