{"release":{"id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","published":"2026-11-10T16:06:46Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2015-12-23","gaps":[],"covered":["PSD2 L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","release_published":"2026-11-10T16:06:46Z","checked_at":"2026-11-09","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/articles/94","url":"https://www.headlesslaw.com/psd2/articles/94","title":"Article 94 — Data protection","family":"l1_generated","work_id":"psd2","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-11","applies_from":null,"application":null,"version_label":"Consolidated version of 23 December 2015","check":{"against":"EUR-Lex","on":"2026-11-09"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02015L2366-20250117","valid_from":"2015-12-23","valid_until":null,"revision":1,"content_id":"72727e7e4ec2dde2","change_date":null,"nearest_versions":["2015-12-23"],"first_text_date":"2015-11-25","correction_applies":false,"versions":["2015-12-23"],"version_url":"https://www.headlesslaw.com/psd2/articles/94/versions/2015-12-23","revision_url":"https://www.headlesslaw.com/psd2/articles/94/versions/2015-12-23/rev/72727e7e4ec2dde2","versions_url":"https://www.headlesslaw.com/psd2/articles/94/versions","relations_url":"https://www.headlesslaw.com/psd2/articles/94/relations","source_line":null,"attribution":null},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02015L2366-20250117","check":{"result":"matched","checked_at":"2026-11-09","against":"EUR-Lex"},"repo_path":null,"body_sha256":"915958ba7cb30db0735d8dcb82cb2ba8fd9214dd715a7e7edc1853d829736ea8","markdown_sha256":"667cbd98898b0da84694405184dd63eb34a3941e44764e8e0330c74a48dc6005"},"units":[{"locator":"psd2/art/94","kind":"article","status":"in_force","label":null,"heading":"Data protection","text":"","marks":[],"revision":1,"text_hash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","reason":null},{"locator":"psd2/art/94/para/1","kind":"paragraph","status":"in_force","label":"1.","heading":null,"text":"Member States shall permit processing of personal data by payment systems and payment service providers when necessary to safeguard the prevention, investigation and detection of payment fraud. The provision of information to individuals about the processing of personal data and the processing of such personal data and any other processing of personal data for the purposes of this Directive shall be carried out in accordance with Directive 95/46/EC, the national rules which transpose Directive 95/46/EC and with Regulation (EC) No 45/2001.","marks":[],"revision":1,"text_hash":"0de4bac807e7b59739ebec013705e005e197dc85bcbfe02a89c99ae441d2c6b1","reason":null},{"locator":"psd2/art/94/para/2","kind":"paragraph","status":"in_force","label":"2.","heading":null,"text":"Payment service providers shall only access, process and retain personal data necessary for the provision of their payment services, with the explicit consent of the payment service user.","marks":[],"revision":1,"text_hash":"66b890637b010662d820131231c24158f8b4d6088ea39a9c512ecf10b39be876","reason":null}],"markdown":"*In force · Consolidated version of 17 January 2025 · Verified 9 Nov 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02015L2366-20250117)*\n\n1. <a id=\"p-1\"></a>Member States shall permit processing of personal data by payment systems and payment service providers when necessary to safeguard the prevention, investigation and detection of payment fraud. The provision of information to individuals about the processing of personal data and the processing of such personal data and any other processing of personal data for the purposes of this Directive shall be carried out in accordance with Directive 95/46/EC, the national rules which transpose Directive 95/46/EC and with Regulation (EC) No 45/2001.\n2. <a id=\"p-2\"></a>Payment service providers shall only access, process and retain personal data necessary for the provision of their payment services, with the explicit consent of the payment service user.\n\n## Related Level 2 and Level 3\n\n### Guidance and Q&A\n\n- [EBA Q&A 2020_5570 — Q&A — Consumer explicit consent to the PISP for processing \\[Final Q&A\\]](../level-3/q-and-a/eba/eba-qa-2020-5570-consumer-explicit-consent-to-the-pisp-for-processing-of.md)\n\n***\n\n[Title IV — Rights and obligations in relation to the provision and use of payment services](../titles/iv.md) · [← Article 93](93.md) · [Article 95 →](95.md)\n"}