Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Juspay is a payments orchestration and checkout platform that provides a hosted checkout, payment routing and fraud prevention, widely used by merchants in India. When its checkout SDK is embedded, it sets cookies for session management, fraud prevention and conversion attribution and processes buyer and payment data. Under the GDPR and the ePrivacy Directive, its non essential cookies require prior consent and transfers to India must be safeguarded.
Juspay is a payments technology company that offers a hosted checkout, payment orchestration across multiple providers, tokenisation and fraud prevention. Founded in 2012 and headquartered in Bangalore, India, it powers the checkout for many large merchants and processes high volumes of transactions. Merchants embed its checkout SDK or redirect buyers to its hosted payment page.
When the Juspay checkout loads it sets cookies for session management, fraud prevention and conversion attribution and reads device data such as IP address and browser. To process a payment it handles identity, contact and payment instrument data and screens transactions for fraud. Some cookies are persistent identifiers used to recognise the device and attribute the transaction.
The attribution and analytics cookies are not strictly necessary, so storing them is governed by Article 5(3) of the ePrivacy Directive and requires consent. Because payment and device data is processed in India, which has no EU adequacy decision, the international transfer obligations of the GDPR also apply.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Block Juspay non essential cookies until the buyer accepts them through a Consent Management Platform, while cookies strictly necessary to complete a requested payment may load. Log consent, make refusal as easy as acceptance, and ensure tracking identifiers are not set before opt in.
Juspay processes data primarily in India, which does not benefit from an EU adequacy decision. Transfers of EU personal data must therefore rely on Standard Contractual Clauses or another Chapter V safeguard, supported by a Transfer Impact Assessment that considers Indian law. Document the recipients and safeguards in your records of processing.
List the Juspay cookies and domains in your cookie policy and gate non essential ones behind consent. Define the controller and processor roles, sign the appropriate data processing terms, and put SCCs and a Transfer Impact Assessment in place for the transfer to India. Review the integration when Juspay updates its checkout.
Websites using Juspay must obtain user consent under GDPR regulations.
DPIA considerations
Juspay processes identity, contact and payment instrument data and screens transactions for fraud. Key DPIA considerations: (1) attribution and analytics cookies are persistent identifiers needing consent; (2) data is processed in India, which has no EU adequacy decision, triggering international transfer obligations; (3) fraud prevention may involve profiling; (4) the controller roles between merchant and Juspay must be defined. A DPIA is advisable because of the payment data and the transfer to a country without adequacy.
Sample consent text
We use Juspay to process your payment. The Juspay checkout sets cookies and processes your identity, contact and payment instrument data, and screens the transaction for fraud, with processing in India. You can withdraw your consent to non essential cookies at any time through our cookie settings.
Third-party domains contacted
juspay.inapi.juspay.insdk.juspay.inCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| juspay_session | Functional | Session | Maintains the buyer session through the Juspay checkout. |
| _jp_attr | Attribution / Analytics | 1 year | Persistent identifier used to attribute completed transactions and recognise returning devices. |
| jp_fraud | Security | 6 months | Supports device recognition and fraud screening during payment. |
Juspay uses cookies for user preferences — inform visitors with a consent banner.
Juspay sets cookies for session management, fraud prevention and conversion attribution when its checkout loads. The attribution and analytics cookies are persistent identifiers that are not strictly necessary, so they require consent, while a narrow set needed to complete a requested payment may be treated as essential.
Yes for the non essential cookies. The attribution and analytics cookies Juspay sets need prior consent under the GDPR and the ePrivacy Directive, so they should not load until the buyer accepts. Cookies strictly necessary to process a requested payment can rely on a different basis.
Consent under Article 6(1)(a) GDPR covers the attribution cookies, while processing needed to complete a payment relies on contract under Article 6(1)(b). Fraud prevention may rely on legitimate interest, with care over any profiling, and the controller roles between you and Juspay should be defined.
Yes. Juspay processes data in India, which has no EU adequacy decision, so transfers of EU personal data must rely on Standard Contractual Clauses or another Chapter V mechanism with a Transfer Impact Assessment that considers Indian surveillance and access laws.
A DPIA is advisable because the processing involves payment data and an international transfer to a country without adequacy. Documenting the purposes, the controller roles, fraud screening and transfer safeguards supports Article 35 GDPR compliance and accountability.
Add Juspay through a CMP that blocks non essential cookies until consent, keep payment essential cookies separate, and define the controller and processor roles. Sign the data processing terms, put SCCs and a Transfer Impact Assessment in place for the India transfer, and disclose cookies and recipients.
Other checkout and payment orchestration platforms include Stripe, Adyen, Checkout.com and Mollie, several of which process data in the EU and can simplify transfer compliance. All set checkout and tracking cookies, so consent gating, clear roles and transfer safeguards remain the priority.
Describe the Juspay cookies, their purpose and duration, list the Juspay domains, and state that payment and device data is processed in India. Explain the transfer safeguards in your privacy notice and keep both aligned with the integration.