IDC Names Securiti a Worldwide Leader in Data Privacy


EDPB recommends collecting consent to store credit card details for future transactions

Published June 2, 2021 / Updated January 8, 2024

Listen to the content

On 19 May 2021, the European Data Protection Board adopted Recommendations on the legal basis for the storage of credit card data for the sole and specific purpose of facilitating further online transactions. They cover the situation where a data subject buys products or pays for a service via a website or an application, and provides credit card data, generally on a dedicated form to conclude the transaction.

The Recommendations go through all the 6 legal bases permitted under the GDPR to determine the lawful legal basis for the storage of credit card data following a purchase, in order to facilitate further purchases. It concludes that consent is the sole appropriate legal basis in this situation.

Let’s look at the consent principles highlighted by the EDPB:

  • Consent must be free, specific, informed and unambiguous.
  • Consent must be delivered by a clear affirmative action.
  • Consent should be requested in a user-friendly way such as through a checkbox, directly on the form used for the data collection. Such a checkbox should not be pre-ticked.
  • Consent for storing credit card data for facilitating further purchases must be distinguished from the consent given for terms of service or of sales and not be a precondition to the completion of the transaction.
  • Data subjects should have the right to withdraw consent at any time. The withdrawal must be free, simple and as easy for the data subject as it was to give consent.
  • Withdrawal of consent must lead to the effective deletion of credit card details stored for the sole purpose of facilitating further transactions.

This indicates that online retailers must not store credit card information after a purchase has taken place without the consent of the data subject. Such consent must meet the standards laid down in the GDPR and the requirements of the EDPB.

Now let’s look at EDPB’s comments on other lawful legal basis for the storage of credit card details following a transaction:

Lawfulness of Processing (Article 6 GDPR)
Legal Basis EDPB’s comments
Compliance with a legal obligation The storage of credit card data following a transaction, in order to facilitate further purchases, cannot be considered necessary for compliance with a legal obligation.
Protection of vital interests of natural persons The storage of credit card data following a transaction, in order to facilitate further purchases, cannot be considered necessary for the protection of vital interests of natural persons.
Performance of a task carried out in the public interest The performance of a task carried out in the public interest or the exercise of official authority vested in the controller cannot be considered as an adequate legal basis in this scenario.
Performance of a contract Whereas, in the first place, the processing of the data related to the credit card used by the data subject to pay is necessary to fulfil the contract, the storage of such data is only useful in order to facilitate the potential next transaction and facilitate the sales. Such a purpose cannot be considered as strictly necessary for the performance of the contract for the provision of the good or service that the data subject has already paid.
Legitimate interests of the controller/third-party The three conditions must be satisfied under GDPR

  1. A legitimate interest pursued by the controller or by a third-party, to be present and effective at the date of the data processing.
  2. The need to process personal data for the purposes of the legitimate interest pursued.
  3. The legitimate interest of the controller or third-party must be balanced against the interests or fundamental rights and freedoms of the data subject.

The test fails on the second and third conditions according to EDPB.

Data subject’s consent Consent appears to be the sole appropriate legal basis for the above-described processing to be lawful.


While analyzing the three conditions required for satisfying the legal basis of legitimate interests of the controller (or a third-party), the EDPB emphasizes that it is not evident whether or not the data subject will be making another purchase in this specific context. The balancing test requires taking into consideration the particular circumstances of the processing, the potential impact on the data subject’s rights and freedoms, and the reasonable expectations of data subjects. The EDPB notes that since credit card data is highly personal, its processing to facilitate further purchases may involve an increased risk of credit card data security breaches. Moreover, the data subject does not reasonably expect his or her credit card data to be stored for longer than what is necessary to pay for the goods or services he/she is buying. As a result, the conditions required may not be fulfilled and the legitimate interests of the controller (or a third-party) may not be an appropriate legal basis to process data.

Therefore, businesses and online retailers must obtain the data subject’s valid consent before storing their credit card details after a purchase, for the sole purpose of facilitating further transactions. The EDPB also emphasizes the need to put in place the appropriate safeguards for data subjects to decrease the risk of unlawful data processing and foster trust in the digital environment.

Privacy Center
Fully Functional In Minutes

Elegant Consumer Frontend, Fully Automated Backend, Privacy Regulation Intelligent Everywhere.


It is worth noting that the Recommendations do not cover payment institutions operating in online stores or public authorities. These EDPB Recommendations are not relevant where the credit card data is stored to comply with a legal obligation or establish a recurring payment, for example, a contract that stipulates the supply of a certain good every month or the subscription for a music or movie streaming service.

Securiti’s Universal Consent Management Solution enables organizations to capture consent and automate consent revocation.

Ask for a DEMO today to understand how Securiti can help you comply with consent requirements of global data privacy laws and regulations, with ease.

Frequently Asked Questions

The European Data Protection Board (EDPB) provides guidelines on consent under the General Data Protection Regulation (GDPR). Consent should be freely given, specific, informed, and an unambiguous indication of the data subject's wishes, signifying agreement to the processing of their personal data.

No, consent is one of the lawful bases for processing personal data under the GDPR, but it's not the only one. Depending on the purpose, you may also process data based on legitimate interests, contractual necessity, legal obligations, or other legal bases.

Article 25 of the EDPB guidelines pertains to data protection by design and by default. It emphasizes the integration of data protection into the development of data processing systems and calls for the implementation of appropriate technical and organizational measures.

The EDPB provides guidelines on obtaining valid consent for cookies, clarifying that cookie walls (requiring consent to access a website) are not compliant with the GDPR. Consent must be freely given, and users should have a genuine choice to accept or reject cookies.

Join Our Newsletter

Get all the latest information, law updates and more delivered to your inbox


More Stories that May Interest You