Pitfall 1: No signed DPA or outdated DPA
The mistake: Many indie teams assume Adyen's privacy policy is sufficient compliance. It is not. GDPR Article 28 legally requires a written Data Processing Agreement. Some teams sign Adyen's DPA but never update it after major checkout changes (e.g., adding 3D Secure, switching to API mode, or integrating a new fraud tool).
Why it happens with Adyen: Adyen's standard DPA is generic and non-negotiable for small teams. Teams often treat it as a "checkbox" rather than an active legal document. When you change how you collect data (e.g., switching from Hosted Payment Page to Client-Side Encryption), the DPA may no longer accurately describe the data flow.
Consequence: GDPR enforcement action. National Data Protection Authorities (e.g., ICO, CNIL) treat missing DPAs as category-one violations. Fines up to €10 million or 2% of annual turnover (GDPR Article 83(4)).
Pitfall 2: Failing to disclose device fingerprinting in privacy policies
The mistake: Privacy policies often mention "payment processing" but omit that Adyen collects IP address, device type, and browser fingerprints for fraud risk assessment. This hidden data collection violates transparency obligations.
Why it happens with Adyen: Device data collection is implicit in Adyen's fraud tools (e.g., Risk Module, Card Testing Detection) but not always visible to integrators. Many founders only document "card and billing address," missing the network/device layer.
Consequence: GDPR Article 13/14 violations (lack of transparency). Under CCPA § 1798.100, California users can file data-sale claims, and regulators can impose fines of $2,500–$7,500 per violation.
Pitfall 3: Misconfiguring consent for cross-border transfers
The mistake: If you're outside the EU but use Adyen N.V. (Netherlands-based), data flows into the EU under Standard Contractual Clauses (SCCs). Some teams in CCPA/UK jurisdictions assume no EU consent is needed; others collect consent in the wrong category ("marketing" instead of "payment processing").
Why it happens with Adyen: Adyen's Terms of Service reference SCCs but don't prominently flag their EU processor status. Teams assume "Adyen handles it" and skip consent documentation for international transfers.
Consequence: Regulatory findings during audits. The EU Court's *Schrems II* decision requires additional safeguards for EU–non-EU transfers. Without clear consent and SCC documentation, a DPA audit will flag inadequate transfer mechanisms (GDPR Chapter V).
