Adyen Sub-processor Update

Key information regarding the addition of new Sub-Processors.

Expansion of the Adyen Infrastructure

We are adding several third-party cloud providers (AWS, Google Cloud, Azure, and Oracle) to our sub-processor list. 

Adding these providers does not materially change how our platform operates today. Adyen’s existing infrastructure, spanning more than 15 datacenters globally, remains the core of our platform. We are continuing our strategy to invest in expanding and evolving this unique infrastructure to power the most reliable, high-performant financial technology services in the world. By augmenting our infrastructure with specialized cloud capabilities, Adyen aims to further advance capabilities and performance of its products and services, all while maintaining the rigorous security and data privacy standards you expect from Adyen.

What this means for you 

Q1. What is changing?

Adyen is onboarding Google Cloud, Microsoft Azure, Amazon Web Services (AWS), and Oracle Cloud Infrastructure as third-party sub-processors to further advance capabilities and performance of its products and services.

These sub-processors will be added to Adyen's authorized sub-processor list, effective September 1, 2026.

Q2. What services will these sub-processors provide?

The new sub-processors will provide Cloud services including but not limited to, cloud infrastructure, storage, compute, and networking.

Q3. Does this mean Adyen is moving its core payment processing to the cloud?

No. Adyen’s existing infrastructure, spanning more than 15 datacenters globally, remains the core of our platform. We are continuing our strategy to invest in expanding and evolving our own infrastructure to power the most reliable, high-performant financial technology services in the world.

Q4. Why is Adyen expanding its sub-processors, and how does this benefit my business? 

We are augmenting our on-premise infrastructure with specialized cloud services to further advance capabilities and performance of our products and services. With this approach we can better adapt to localized requirements and advanced technical workloads needs, benefiting your business in the following ways:

• Regional compliance and data residency: By leveraging cloud capabilities, we can rapidly deploy local infrastructure to meet data residency requirements of specific markets. This supports expansion to such markets seamlessly and in full compliance with local mandates. 

• Product and feature optimization: For advanced technical and analytical workloads, the cloud provides supplemental, on-demand access to specialized, high-performance computing hardware. This supports continuous acceleration for product and feature development in case of global supply chain risks.

Data Protection & Security

Q5. What personal data will be processed by these sub-processors?

The sub-processors will process personal data only to the extent necessary to perform the described services. This may include transaction data, pseudonymized or fully anonymized data. Adyen applies data minimization principles, processing only the data required for the specific purpose. 

Q6. Will security measures remain at the same level?

Yes. Adyen’s commitment to security has not changed. We have implemented technical safeguards to ensure a similar level of security.

Q7. What due diligence has Adyen performed on these sub-processors?

Adyen has conducted a comprehensive assessment process for each sub-processor in accordance with our Third-Party Risk Management Policy. These assessments include:

• Security reviews: A deep dive into each sub-processor’s security certifications and reports. Each provider has been audited against SOC 2 and ISO 27001 standards.

• Legal alignment: Our legal team has reviewed and negotiated each sub-processor's Master Service Agreement and Data Processing Agreement (DPA) to ensure back-to-back alignment with Adyen's existing merchant obligations.

• International transfers: If and where required, Standard Contractual Clauses (SCCs) are in place for any data transfers occurring outside the EEA to ensure continuous protection.

Q8. If my data is compromised while being processed by a third-party cloud provider, will Adyen continue to be responsible?

Yes. We stand behind the security and integrity of our entire platform and will remain fully responsible for all data processing obligations, including those handled by our sub-processors. This is in accordance with applicable data protection laws (including GDPR) and our agreement with you, which may include a Data Processing Agreement.

Data Sovereignty 

Q9. How is the transfer of data to non-EEA sub-processors legally justified under the GDPR?   

For all sub-processors located outside the EEA, Adyen ensures any transfer is facilitated by putting in place a valid transfer mechanism. These mechanisms include, ensuring that Standard Contractual Clauses (SCCs) are in place, or reliance on an Adequacy decision for example. Furthermore, we conduct comprehensive Transfer Impact Assessments (TIAs) where appropriate, before any data disclosure to ensure the data receives a level of protection essentially equivalent to that guaranteed within the EU. 

Q10. Are current processing locations changing as a result of this update? 

No, current processing locations are not changing as a result of this update. 

Q11. How will Adyen handle data residency requirements?

While cloud providers are US-based, Adyen utilizes regional capabilities to meet local data residency needs. 

Q12. How do we know these large US providers are being held to the same standards as Adyen, including EU privacy standards? 

Every sub-processor undergoes a rigorous vetting process following Adyen’s Third-Party Risk Management Policy, including audits against SOC 2 and ISO 27001 where required. Contractually, Adyen imposes materially equivalent data protection obligations on the sub-processor to ensure back-to-back alignment with our existing merchant commitments.  

Legal Questions

Q13. Do I need to update my agreement with Adyen?

In most cases, no action is required. Adyen's standard agreement and/or DPA allows for the addition of sub-processors subject to prior notice, which has been provided to you. If your agreement contains specific provisions that differ from these standard terms, your Account Manager or Support team will work with you directly.

Q14. Can I object to the addition of new sub-processors? If so, how? 

Yes. If you identify a specific data protection risk, you may submit a written objection to your Account Manager or through help.adyen.com/contact within 30 days of this notice (or within the notice period provided in your contract).

To ensure a meaningful review, your objection should identify:

• The relevant sub-processor.

• The specific concern regarding their engagement.

• The data protection grounds for the objection.

Our team will then work with you to provide any information you may require on the scope of their services and the security measures in place to protect your data. If we do not hear from you within the relevant objection window, the sub-processor changes will be deemed accepted.

Q15. Where can I find the current list of Adyen's sub-processors?

Adyen's up-to-date sub-processor list is published on the Adyen website. You can subscribe to receive automatic email notifications whenever the list is updated by visiting that page. 

Q16. Does Adyen plan to add more sub-processors in the future?

No, there are no plans to update the sub-processor list beyond what is currently included at this stage. This expansion was a highly targeted, strategic decision, strictly scoped to support specific infrastructure enhancements. It was designed specifically to meet regional data residency requirements and secure specialized, high-performance computing hardware for advanced workloads—two key capabilities that will help our customers scale globally and access new tools faster.

Our product, commercial, and legal teams worked in close alignment to ensure this list provides exhaustive, long-term operational coverage across our global merchant base including our largest and most complex merchants.

Q17. Where do I go with questions?

For further questions, please contact your Adyen Account Manager or visit help.adyen.com/contact