Adyen Subprocessors List (September 2026): Changes and History
Adyen names 15 subprocessors on its published list. Read from the vendor's own page and re-checked daily.
Last checked September 26, 2026
Official source ↗
Adyen subprocessors (September 2026)
| # | Subprocessor | Purpose | Location |
|---|---|---|---|
| 1 | Adyen N.V. UK Branch | — | United Kingdom |
| 2 | Adyen do Brasil Instituição de Pagamento Ltda. | — | Brasil |
| 3 | Adyen Mexico SA de CV | — | México |
| 4 | Adyen N.V. (San Francisco Branch) | — | USA |
| 5 | Adyen Australia Pty Ltd | — | Australia |
| 6 | Adyen Singapore Pte. Ltd. | — | Singapore |
| 7 | Adyen Japan K.K. | — | Japan |
| 8 | Adyen Canada Ltd. | — | Canada |
| 9 | Adyen MEA FZ-LLC | — | United Arab Emirates |
| 10 | Adyen India Technology Services Pvt. Ltd. | — | India |
| 11 | Adyen India Tech Hub Pvt. Ltd. | — | India |
| 12 | Amazon Web Services, Inc. | Cloud services, including cloud infrastructure, storage, compute, and networking | — |
| 13 | Google LLC | Cloud services, including cloud infrastructure, storage, compute, and networking | — |
| 14 | Microsoft Corporation | Cloud services, including cloud infrastructure, storage, compute, and networking | — |
| 15 | Oracle Corporation | Cloud services, including cloud infrastructure, storage, compute, and networking | — |
Get an email when Adyen changes its subprocessors
ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.
Key DPA terms at Adyen
What Adyen's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?
- Breach notification
-
Without undue delay, with no set deadline
“Processor will notify Controller without undue delay, and in order for the Controller to meet its notification obligations under Data Protection Laws, after becoming aware of a Personal Data Breach.”
DPA, www.adyen.com ↗ - Notice of a new subprocessor
-
30 days ahead
“Controller shall be given thirty (30) days to object, duly motivated and in writing, after receiving such notification.”
DPA, www.adyen.com ↗ - Transfers outside the EU
-
Standard contractual clauses
“The Standard Contractual Clauses in Annex 6 safeguard the data transfer to Sub-Processors.”
DPA, www.adyen.com ↗ - Customer data after the contract ends
-
Deleted or returned when the contract ends
“Processor will, upon termination or expiration of this DPA, return or delete any Personal Data on Controller's request.”
DPA, www.adyen.com ↗ - Liability cap
-
Total Processing Fees paid in the previous calendar year
“The total liability of Processor under this indemnity provision will be limited to an amount equal to the total Processing Fees paid by Merchant to Adyen during the previous full calendar year”
DPA, www.adyen.com ↗ - Audit rights
-
Through certifications and audit reports only
“The parties agree and acknowledge that delivery of Adyen's annual ISAE 3402/SOC 2 audit report and PCI DSS Attestation of Compliance will suffice Adyen's obligations to Merchant under this Clause 3 or any other similar audit requirement under Data Protection Laws.”
DPA, www.adyen.com ↗
Documents we track for Adyen
- DPA
- checked September 26, 2026 www.adyen.com ↗
- Privacy policy
- checked September 26, 2026 www.adyen.com ↗
- Subprocessor list
- checked September 26, 2026 www.adyen.com ↗
Change history
Tracking since September 26, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.
Adyen subprocessors FAQ
- How many subprocessors does Adyen use?
- Adyen lists 15 subprocessors on its published list, including Adyen N.V. UK Branch, Adyen do Brasil Instituição de Pagamento Ltda., Adyen Mexico SA de CV, Adyen N.V. (San Francisco Branch), and Adyen Australia Pty Ltd and 10 more.
- Where does Adyen process customer data?
- The subprocessors named by Adyen are located in India, Australia, Brasil, Canada, Japan, and México and 4 other locations, as stated on its list.
- How quickly does Adyen report a personal data breach to customers?
- According to its DPA, Adyen reports a personal data breach to customers without undue delay, with no set deadline: “Processor will notify Controller without undue delay, and in order for the Controller to meet its notification obligations under Data Protection Laws, after becoming aware of a Personal Data Breach.”
- How much notice does Adyen give before adding a subprocessor?
- Adyen's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “Controller shall be given thirty (30) days to object, duly motivated and in writing, after receiving such notification.”
- How does Adyen transfer personal data outside the EU?
- Adyen's DPA relies on standard contractual clauses: “The Standard Contractual Clauses in Annex 6 safeguard the data transfer to Sub-Processors.”
- When was Adyen's subprocessor list last checked?
- ClauseTrail last checked Adyen's subprocessor list on September 26, 2026. Lists are re-checked daily.
- How do I find out when Adyen adds or removes a subprocessor?
- ClauseTrail monitors Adyen's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.