Is this a one of the only ways to legally avoid data privacy laws for payment processing?
<p>Stripe offers a <a href="https://stripe.com/docs/payments/checkout" rel="nofollow noreferrer">checkout</a> system where there is a <strong>stripe</strong> hosted page. Here I am redirecting the user to stripe's page for payment. So in that case I am not collecting anything . I am just redirecting to stripe's page. Will link to the following page: <a href="https://stripe.com/en-in/privacy" rel="nofollow noreferrer">https://stripe.com/en-in/privacy</a>
and state that we do not selling data from stripe except to required legal authorities under obligation. So basically all information is collected by stripe directly by their data requests must be addressed by stripe. So I am NOT liable    right?<em>This is a brilliant service from <a href="https://stripe.com" rel="nofollow noreferrer">stripe</a>.</em></p>

<h2>So you’re not collecting payment data. What about all the other data?</h2>
<p>So you have a user. You direct them to stripe. They come back. How do you know they paid?</p>
<p>You have to be collecting some personal data that links the user who left to the user who returned as well as something that links them to the payment.</p>
<p>You have to comply with the law for that data.</p>

<p>For small and medium businesses, it can be an <em>excellent</em> idea to turn to a payment provider who specializes in such services. There are more than the one mentioned by the OP. Lawfully handling credit card data on your own site is a <em>serious</em> hassle.</p>
<p>The business would still be required to handle all other personal data in accordance with all applicable laws and regulations. The EU has decided that their GDPR applies worldwide as long as the data subject is in the EU. (Extraterritorial laws are hardly unusual, just look at US sanctions on various rogue nations, but enforcement can be spotty.)</p>

privacy