Security and data protection with Mollie: what shop owners need to know

Payment data is the most sensitive thing that passes through an online shop. If you use Mollie as your payment provider, you want to know two things: how secure is your customers’ data, and what do you have to take care of yourself for the GDPR?

I regularly set up Mollie in WooCommerce shops in Austria and Germany. Here is my overview, without the marketing speak and with the points that actually come up in practice.

The short answer

• Mollie meets the PCI DSS card standard at the highest level. If set up correctly, card data never reaches your server.
• 3-D Secure and strong customer authentication under PSD2 run automatically.
• Mollie is a licensed electronic money institution based in the Netherlands and supervised by the Dutch central bank.
• Under data protection law, Mollie acts as an independent controller for payment processing, not as a processor. That has consequences for the data processing agreement and your privacy policy.

If you are not familiar with Mollie yet, read my overview What is Mollie? Payment methods and fees first.

PCI DSS: what it means for you

PCI DSS is the security standard of the card schemes. Every company that processes, stores or transmits credit card data has to comply with it. According to Mollie, it meets the highest level and proves this with an Attestation of Compliance. On top of that come an independent audit against the AICPA Trust Services Criteria and an annual review by external auditors.

For you as a shop owner, the decisive point is a different one: where is the card data entered? The Mollie plugin for WooCommerce offers two options. Either your shop redirects to Mollie’s hosted checkout, or the card fields are embedded directly into your checkout via Mollie Components. In both cases, your customers type their card number into a field served by Mollie. Your WordPress site never sees the data.

That is a good thing. It keeps your shop out of the laborious part of the PCI obligations. So do not build your own card fields and do not install plugins that want to “cache” payment data.

3-D Secure, PSD2 and strong customer authentication

Since the EU Payment Services Directive PSD2, strong customer authentication (SCA) applies in the EEA. For card payments, this means 3-D Secure in practice: the customer confirms the payment in an additional step, usually in their banking app.

Mollie handles this automatically. You do not need to configure anything. Some payments qualify for an exemption, for example very small amounts, and then the confirmation is skipped. Mollie and the customer’s bank decide that.

An advantage many people overlook: if a payment was confirmed via 3-D Secure, the liability for a later fraud claim usually no longer lies with you. That protects small shops in particular from nasty surprises.

Fraud prevention

Mollie continuously checks transactions for unusual patterns and blocks suspicious payments. According to Mollie, a security team monitors the systems around the clock, and internal testers carry out penetration tests. Your customers notice none of this as long as everything runs normally.

What you can do yourself: protect your Mollie account with two-factor authentication and give staff in the dashboard only the permissions they really need. Most of the problems I see do not originate at Mollie, but with a weak password in the shop or in the payment dashboard.

Where is the data processed?

Mollie B.V. is based in Amsterdam and licensed by De Nederlandsche Bank as an electronic money institution. This means Mollie is subject to European financial supervision and to the GDPR. For the UK market there is a separate company with an FCA licence.

To be honest: I cannot promise you that “everything stays in the EU”, and Mollie does not promise that either. According to its privacy policy, Mollie’s service providers may process personal data outside the EEA in individual cases. Mollie then safeguards such transfers with the appropriate contracts and EU standard contractual clauses. That is the usual standard among European payment providers.

Data processing agreement: do you need one with Mollie?

This is where the most common misconception lies. Many checklists say across the board: “Sign a data processing agreement with every service provider.” For Mollie’s payment processing, that does not fit.

Mollie states in its own privacy policy that it acts as a controller within the meaning of the GDPR for payment processing. That is common for regulated payment institutions: they have to process data under their own legal obligations, for example for anti-money-laundering checks and retention periods. A processor, by contrast, works only on your instructions. That does not apply to a bank.

The result: for payment processing you generally do not need a data processing agreement with Mollie. Mollie itself names one exception: if you use Mollie’s invoicing product, Mollie is a processor for that. Then a data processing agreement is required.

I am not a lawyer. If your shop processes special categories of data or you are unsure, have this checked by a legal adviser. But the basis is clear and set out in black and white by Mollie.

What belongs in your privacy policy

Mollie must be mentioned in your privacy policy. You should cover these points:

• Recipient: Mollie B.V., Amsterdam, as an independent controller for payment processing, with a link to Mollie’s privacy policy.
• Which data: name, billing address, email, order amount, payment details for the chosen payment method, IP address and technical data from the checkout.
• Purpose and legal basis: performance of the purchase contract (Art. 6(1)(b) GDPR), plus legal obligations and fraud prevention.
• Other providers: if you offer Klarna, PayPal or Apple Pay via Mollie, these providers are additional recipients.
• Transfers to third countries: a note that Mollie has data processed outside the EEA in individual cases on the basis of standard contractual clauses.

How to set up your shop on a sound legal footing overall is something I describe in Launching WooCommerce in Austria the legally sound way.

Notes on setting it up in WooCommerce

The official “Mollie Payments for WooCommerce” plugin is free. A few points I check on every setup:

1. Test mode first: Mollie gives you a test API key and a live API key. Test every payment method once in test mode before you go live.
2. Protect your API keys: the keys belong in the plugin settings, not in screenshots, emails or support tickets.
3. Keep webhooks reachable: Mollie reports the payment status back to your shop. A maintenance mode, password protection on the website or an overly strict firewall will block these notifications. Orders then get stuck on “Pending payment”.
4. SSL everywhere: a shop without valid HTTPS does not belong online.
5. Install updates: keep the Mollie plugin, WooCommerce and WordPress up to date. Most security holes in shops come from outdated software, not from the payment provider.

Whether Mollie or Stripe is the better fit for your shop is something I compare in Stripe vs. Mollie. Both are at a comparable level in terms of security. The difference lies more in payment methods and fees.

My conclusion

When it comes to payment security, Mollie takes almost everything off your hands: PCI DSS, 3-D Secure and fraud checks run in the background. Your part is manageable, but it exists: word your privacy policy correctly, secure your logins, keep your shop up to date.

If you want to set up your WooCommerce shop with Mollie yourself and understand what happens along the way, I will show you in my WooCommerce training, remotely and 1:1 on your own shop.

Frequently asked questions

Is Mollie GDPR-compliant?

Mollie is an electronic money institution licensed in the Netherlands and is subject to the GDPR. According to its own privacy policy, Mollie safeguards transfers outside the EEA with standard contractual clauses. You still have to update your own privacy policy.

Do I need a data processing agreement with Mollie?

Generally not for payment processing. Mollie acts as an independent controller for that. Only for Mollie’s invoicing product is Mollie a processor, and then you need a data processing agreement.

Can my shop see my customers’ credit card details?

No, if you use the official plugin. The card details are entered in Mollie’s hosted checkout or in embedded Mollie fields and never reach your server.

Do I have to activate 3-D Secure myself?

No. Mollie carries out strong customer authentication under PSD2 automatically. Whether a payment needs confirmation is decided by Mollie and the customer’s bank.

Where is Mollie based?

Mollie B.V. is based in Amsterdam and supervised by De Nederlandsche Bank. For the UK there is a separate company with an FCA licence.