--- title: GDPR explicit consent vs. PSD2 explicit consent description: "The term \" explicit consent \" in the GDPR has a very different meaning in the PSD2" image: https://blog.spaycial.com/hubfs/RGPD%20VS%20DSP2_EN.jpg --- [![LOGO_SPAYCIAL](https://blog.spaycial.com/hubfs/LOGOSPAYCIAL.svg "LOGO_SPAYCIAL")](https://www.spaycial.com/?hsLang=en) - [How it works](https://www.spaycial.com/how-it-works?hsLang=en) - [Our platform](https://www.spaycial.com/for-a-company?hsLang=en) - [Features](https://www.spaycial.com/for-a-company?hsLang=en) - [Use cases](https://www.spaycial.com/for-a-company?hsLang=en#use-cases) - [Pricing](https://www.spaycial.com/our-pricing?hsLang=en) - [Resources](https://www.spaycial.com/for-a-company?hsLang=en#resources) - [Blog](https://blog.spaycial.com/en/blog) [![GET IN TOUCH](https://no-cache.hubspot.com/cta/default/19609184/ef6392cc-c03f-46e2-aebb-c03cf85ba596.png)](https://cta-redirect.hubspot.com/cta/redirect/19609184/ef6392cc-c03f-46e2-aebb-c03cf85ba596) - [English](https://blog.spaycial.com/en/blog/gdpr-psd2-explicit-consent) - [Français](https://blog.spaycial.com/fr/blog/consentement-explicite-rgpd-vs.-consentement-explicite-dsp2) English [Back to blog](https://blog.spaycial.com/en/blog) # GDPR explicit consent vs. PSD2 explicit consent [![](https://app.hubspot.com/settings/avatar/ca718c89474a4c1d365e41ca24e3538a)  BDV](https://blog.spaycial.com/en/blog/author/bdv)  | May 27, 2022 8:28 AM [GDPR](https://blog.spaycial.com/en/blog/tag/gdpr), [consent](https://blog.spaycial.com/en/blog/tag/consent), [PSD2](https://blog.spaycial.com/en/blog/tag/psd2) ![](https://blog.spaycial.com/hubfs/RGPD%20VS%20DSP2_EN.jpg) We regularly talk to you about the importance of consent in the day-to-day running of our business, and we've already covered it extensively: from [privacy by design](https://blog.spaycial.com/en/blog/what-is-privacy-by-design?hsLang=en), to the construction of our [new funnel](https://blog.spaycial.com/en/blog/our-new-funnel-ux-centered-and-gdpr-friendly?hsLang=en) and its inclusion at the heart of the [strong authentication principle](https://blog.spaycial.com/en/blog/strong-customer-authentication-what-does-the-new-longer-mandatory-exemption-mean-for-shoppers?hsLang=en), it is the keystone of our service to shoppers. We go even further by comparing the famous GDPR explicit consent to the PSD2 explicit consent that concerns us. [What is PSD2?](https://blog.spaycial.com/en/blog/what-is-psd2?hsLang=en) The promotion of open banking in 2018 by PSD2 -the Payment Services Directive- opened the possibility for [account aggregators](https://blog.spaycial.com/en/blog/what-is-a-bank-account-aggregator?hsLang=en) to access shoppers' payment data, with their consent. [Consent, from 90 to 180 days](https://blog.spaycial.com/en/blog/strong-customer-authentication-what-does-the-new-longer-mandatory-exemption-mean-for-shoppers?hsLang=en) With the shopper's permission, it is now possible for merchants (retailers, shopping centres, brands) to offer a multitude of benefits to shoppers (account aggregation, rewards, cashback, e-ticket, buy now pay later, etc.) and to access unparalleled shopper knowledge (shopping cart, itinerary, profile, scoring) thanks to the APIs developed by these payment providers. PSD2 puts consent at the heart of payment data. Since the notion of "explicit consent" is present in both PSD2 and the General Data Protection Regulation (GDPR), it is very tempting to compare them. However, the term "explicit consent" in the GDPR has a very different meaning in the PSD2. Our Head of Legal, Nurgül Sivasli, explains. #### Be RGPD compliant [Payment data](https://blog.spaycial.com/en/blog/payment-data-in-a-cookieless-world?hsLang=en) is highly confidential and by nature personal data. Its processing therefore requires a legal basis to comply with the RGPD. [GDPR and payment data: what are the main stakes?](https://blog.spaycial.com/_hcms/analytics/search/conversion?redirect=aHR0cHM6Ly9ibG9nLnNwYXljaWFsLmNvbS9lbi9ibG9nL2dkcHItYW5kLXBheW1lbnQtZGF0YS13aGF0LWFyZS10aGUtc3Rha2Vz&ct=AUTOCOMPLETE&pid=19609184&cid=56444737137&t=Z2Rwcg%3D%3D&d=blog.spaycial.com&c=2&c=3&c=6&rp=1&ab=false&opcid=&rs=UNKNOWN&hs-expires=1688486551&hs-version=1&hs-signature=APUk-v4UsY6oVHDzxeNfkzMWddYbwhwJBw&hsLang=en) There are 6 possible legal bases in the GDPR and this list is complete: 1. Consent 2. Contract 3. Legal obligation  4. Public interest mission 5. Legitimate interest 6. Safeguarding vital interests In the GDPR, consent is therefore one of the 6 legal bases indicated in Article 6 of the GDPR, which can justify the implementation of account information processing, but it is only mandatory in very specific cases. For instance, when sensitive data is collected (art.9), to allow an automated individual decision (art.22) or in case of transfer of personal data outside the European Union (art.49). This GDPR consent is stronger than a classic consent and requires a positive and clear act, most often illustrated by a checkbox accompanied by a statement of consent such as: *"I authorize X to process my personal data for Y purpose".* #### PSD2, contractual in nature In the PSD2, explicit consent is a contractual consent. It is the legal basis for the processing of personal data necessary for the execution of payment services. It is the pure execution of the contract (art. 94 PSD2).  During the execution of this contract, the consent of the data subject is not required. The data subject will have to terminate the contract (general terms of sale or user) in order to no longer have his or her personal data processed, or wait for the [90-day period for renewal of consent (soon to be 180)](https://blog.spaycial.com/en/blog/strong-customer-authentication-what-does-the-new-longer-mandatory-exemption-mean-for-shoppers?hsLang=en). ![AUTH_4in1-1](https://blog.spaycial.com/hs-fs/hubfs/AUTH_4in1-1.png?width=2400&name=AUTH_4in1-1.png) Thus, if the data processing is not expressly provided for in the contract, it will not be possible for the service provider to carry it out. Everything must take place within the strict framework of the contract, which also leaves no room for further use of the data for reasons not provided for in the contract. ## On the same subject ### [Let us explain: how do we recover your payment data](https://blog.spaycial.com/en/blog/let-us-explain-how-do-we-recover-your-payment-data?hsLang=en) [BDV](https://blog.spaycial.com/en/blog/author/bdv) [Security](https://blog.spaycial.com/en/blog/tag/security), [Payment Data](https://blog.spaycial.com/en/blog/tag/payment-data), [Privacy](https://blog.spaycial.com/en/blog/tag/privacy), [consent](https://blog.spaycial.com/en/blog/tag/consent), [PSD2](https://blog.spaycial.com/en/blog/tag/psd2) ### [Fact-Checking 100% Privacy: 3 fears and fantasies about your payment data](https://blog.spaycial.com/en/blog/fact-checking-100-privacy-3-fears-and-fantasies-about-your-payment-data?hsLang=en) [BDV](https://blog.spaycial.com/en/blog/author/bdv) [Payment Data](https://blog.spaycial.com/en/blog/tag/payment-data), [GDPR](https://blog.spaycial.com/en/blog/tag/gdpr), [consent](https://blog.spaycial.com/en/blog/tag/consent), [PSD2](https://blog.spaycial.com/en/blog/tag/psd2) ### [Our new funnel, simple, seamless and secure, designed for the ultimate shopper's experience](https://blog.spaycial.com/en/blog/our-new-funnel-ux-centered-and-gdpr-friendly?hsLang=en) [BDV](https://blog.spaycial.com/en/blog/author/bdv) [Funnel](https://blog.spaycial.com/en/blog/tag/funnel), [GDPR](https://blog.spaycial.com/en/blog/tag/gdpr), [consent](https://blog.spaycial.com/en/blog/tag/consent) [![LOGOSPAYCIAL](https://blog.spaycial.com/hubfs/LOGOSPAYCIAL.svg "LOGOSPAYCIAL")](https://blog.spaycial.com/?hsLang=en) - [About us](https://www.spaycial.com/about-us) - [About Spaycial](https://www.spaycial.com/about-us) - [Press](https://www.spaycial.com/spaycial-press) - [Privacy & Security](https://www.spaycial.com/security-and-privacy) - [Legal Notices](https://www.spaycial.com/legal-notices) - [Cookie Policy](https://www.spaycial.com/cookie-policy) - [Join us](https://www.spaycial.com/join-spaycial) - [Contact us](https://www.spaycial.com/contact) - [Resources](https://www.spaycial.com/for-a-company#resources) - [Developers](https://developer.transactionconnect.com/) - [Integrations](https://www.spaycial.com/for-a-company#resources) All rights reserved Spaycial 2022. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "BDV", "url" : "https://blog.spaycial.com/en/blog/author/bdv" }, "dateModified" : "2022-07-05T06:32:38.596Z", "datePublished" : "2022-05-27T06:28:00.000Z", "headline" : "GDPR explicit consent vs. PSD2 explicit consent", "image" : [ "https://blog.spaycial.com/hubfs/RGPD%20VS%20DSP2_EN.jpg" ], "mainEntityOfPage" : { "@id" : "https://blog.spaycial.com/en/blog/gdpr-psd2-explicit-consent", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.spaycial.com/hubfs/06_21_Spaycial_LogoNoir-1.png" }, "name" : "Spaycial" } } ```