The General Data Protection Regulation (GDPR) is one of the most comprehensive data protection laws in the world, applying based on what an organization does with personal data, not simply where the company is registered. A business based outside the EU can still fall under the GDPR if it offers goods or services to people in the EU or monitors their behavior in the EU. This can apply regardless of the business model, including B2C, B2B, and dropshipping.
GDPR compliance in eCommerce is not limited to adding a privacy policy or a consent checkbox. It covers the entire lifecycle of personal data, including what the store collects, why it collects it, which legal basis applies, where the data goes, how it is protected, and how requests or breaches are handled.
This article explains the main GDPR requirements that online stores need to consider, with a focus on the practical and technical measures that support compliance. Because the exact obligations depend on the store's business model, data processing activities and applicable national laws, legal or data protection advice may be necessary for individual cases.
What data a typical online store collects, and on what legal basis
Before deciding to collect data, an online store should understand it can process much more personal data than the information a customer enters during checkout. This may include names, delivery and billing addresses, email addresses, phone numbers, order history, account information, IP addresses, device information and data generated through analytics or marketing tools.
Each processing activity needs an appropriate legal basis under Article 6 GDPR. The GDPR provides six possible legal bases, although four are particularly common in eCommerce:
- Contract performance - for processing that is necessary to fulfill an order or provide a service requested by the customer.
- Legal obligation - for processing required by law, such as keeping accounting or tax records.
- Legitimate interests - for processing that is necessary for a legitimate interest of the store or a third party, provided that this interest is not overridden by the individual's rights and freedoms.
- Consent - where the law requires or the organization chooses to rely on the individual's freely given, specific, informed and unambiguous consent.
The appropriate basis depends on the purpose of the processing. A store should not ask for consent simply because it is convenient if the processing is actually necessary to fulfill a contract or comply with a legal obligation.
Legitimate interest also cannot be treated as a universal alternative to consent. For example, electronic direct marketing may be subject to additional requirements under ePrivacy rules and national legislation. The GDPR legal basis and the rules governing the communication channel therefore need to be considered together.
Data minimization and purpose limitation
Data collection should be limited to what an online store actually needs for a defined purpose. Asking customers for additional information simply because it might be useful in the future can conflict with the GDPR's data minimization principle. The same principle applies to how the data is used: information collected for one purpose should not automatically be reused for an unrelated purpose without an appropriate legal basis and, where required, additional information or consent.
This is particularly important when adding new marketing, analytics, or personalization tools. Before collecting another piece of customer data, the store should be able to explain why it is needed and how it will be used.
Consent: how to collect it properly
When a store relies on consent, that consent must meet the requirements of the GDPR: informed consent that is freely given, specific, and unambiguous, with the customer able to withdraw it at any time.
Different purposes should not be bundled into one vague consent. A newsletter, personalized marketing and certain forms of profiling may involve different processing purposes and may therefore require separate choices.
Consent also cannot normally be made a condition of purchasing a product when the processing is not necessary for fulfilling the contract. Similarly, withdrawing consent should be as easy as giving it.
A practical example is a newsletter checkbox at checkout. The customer should be able to complete the purchase without subscribing to the newsletter, and the store should be able to demonstrate what the customer consented to and when.
For cookies and similar technologies, additional ePrivacy requirements may apply. Non-essential cookies and tracking technologies generally cannot simply be activated before the required consent has been obtained.
How the privacy policy should work
A privacy policy is one of the most visible parts of a store's data privacy practices, and it should describe what the store actually does with personal data. A generic template can easily become inaccurate when it lists services the store does not use or fails to mention tools and processing activities that it does use.
Information provided to customers should cover the relevant processing activities and explain, among other things, what data is processed, why it is processed, the applicable legal basis, how long the data is retained, who receives it, and what rights individuals have.
The document also needs to remain aligned with the store's actual technology stack. Adding a new analytics platform, marketing tool, payment provider or customer-service system can change the store's processing activities and may require the privacy information to be reviewed.
Cookies and tracking
Cookies and similar technologies need to be considered separately from the general GDPR legal-basis analysis because ePrivacy rules can impose additional requirements.
Non-essential tracking technologies, including many analytics and marketing tools, generally require the appropriate consent before they are activated. A cookie banner therefore needs to do more than display a message: it needs to reflect the user's choice in the actual behavior of the website.
A compliant implementation should not load non-essential tracking simply because the consent banner is displayed. If a visitor refuses consent, the relevant technologies should remain disabled.
The practical way to verify this is to test the implementation. Open the store in a fresh or private browser session, reject non-essential cookies, and inspect the network requests and loaded scripts. The technical implementation should match the choice presented to the user.
Data security: technical and organizational measures
GDPR requires organizations to implement appropriate technical and organizational security measures to protect customer data. These measures should be proportionate to the risks associated with the processing.
For an online store, this can include:
- keeping the platform, modules, and dependencies supported and patched
- restricting access to personal data according to employees' roles and responsibilities
- protecting administrative accounts with appropriate authentication and access controls
- using encryption where appropriate, particularly for data in transit and sensitive data at rest
- ensuring that passwords are never stored in plaintext and are protected using an appropriate password-hashing mechanism
- maintaining reliable backups and testing whether they can actually be restored
- logging relevant administrative activity where appropriate
- having a process for detecting, assessing and responding to security incidents
These measures are not simply a technical checklist. The GDPR follows a risk-based approach, so what is appropriate depends on the nature, scope, context and risks of the processing.
A secure store therefore needs both technical controls and organizational processes. A policy that promises strong protection but is not reflected in the actual configuration of the platform does not provide meaningful compliance.
Customer rights under GDPR
Individuals have a number of rights concerning their personal data, and an online store needs a practical process for handling requests.
These include:
- Right of access - the right to obtain information about the processing of personal data and, in certain circumstances, a copy of that data.
- Right to rectification - the right to have inaccurate personal data corrected.
- Right to erasure - the right to request deletion of personal data in certain circumstances. This is not absolute and does not override legal obligations to retain information.
- Right to restriction of processing - the right to request that processing be restricted in certain circumstances.
- Right to data portability - in applicable cases, the right to receive personal data in a structured, commonly used and machine-readable format and transmit it to another controller.
- Right to object - the right to object to certain types of processing. This right is particularly strong in relation to direct marketing.
- Rights relating to automated decision-making and profiling - additional protections can apply where decisions are based solely on automated processing and produce legal or similarly significant effects.
- Right to withdraw consent - where processing is based on consent, it can generally be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
The store should have a defined process for receiving, verifying, and responding to these requests within the applicable deadlines.
In general, the controller should respond without undue delay and at the latest within one month. This period can be extended by up to two further months where necessary because of the complexity or number of requests, but the individual must be informed about the extension within the first month.
Processing agreements with external parties
Online stores rarely process personal data in isolation. Hosting providers, email platforms, customer-support systems, analytics providers and other services may process data on behalf of the store.
Where a service provider acts as a processor under Article 28 GDPR, the relationship needs to meet the requirements of that article, including an appropriate data processing agreement or other legally valid arrangement.
Not every external company that receives or accesses customer data is automatically a processor. The role depends on how the parties determine the purposes and means of processing.
This distinction matters particularly for services such as payment providers, logistics companies and fulfillment partners. Depending on the circumstances, they may act as processors, independent controllers or have another role. The store should therefore assess each relationship rather than assuming that every vendor requires the same type of agreement.
The store should also maintain an up-to-date overview of the external services involved in processing personal data and understand what data each service receives.
Data transfers outside the EEA
Online stores increasingly rely on cloud, analytics, marketing and SaaS providers that may involve transfers of personal data outside the European Economic Area.
Such transfers are governed by Chapter V of the GDPR and require an appropriate transfer mechanism. Depending on the circumstances, this can include:
- an adequacy decision by the European Commission;
- Standard Contractual Clauses (SCCs);
- Binding Corporate Rules;
- or, in limited circumstances, one of the derogations provided by Article 49 GDPR.
Depending on the circumstances, supplementary technical, contractual or organizational measures may also be necessary when relying on certain transfer mechanisms.
The relevant transfer mechanism should be assessed for the actual service and data flow involved. It is not enough to look only at where the store itself is located: a provider's infrastructure, subprocessors and data-processing arrangements may also be relevant.
For this reason, international transfers should be part of the store's vendor and data-flow review rather than treated as a one-time technical configuration.
Internal documentation and accountability
GDPR requires organizations to be able to demonstrate compliance, which means that important processing activities and decisions should be documented appropriately.
One key document is the Record of Processing Activities (ROPA) under Article 30 GDPR. The general obligation applies to controllers and processors, although Article 30(5) provides a limited exemption for organizations employing fewer than 250 people when the statutory conditions are met. The exemption does not apply simply because a store is small: the processing must also meet the other conditions specified in Article 30(5), including requirements concerning whether the processing is occasional, whether it involves special categories of data or criminal-conviction data, and whether it is likely to result in a risk to the rights and freedoms of individuals.
Beyond the ROPA, stores should maintain appropriate processes and evidence for areas such as:
- handling data subject requests
- responding to personal data breaches
- managing data retention and deletion
- assessing data protection risks
- carrying out a Data Protection Impact Assessment (DPIA) where processing is likely to result in a high risk to individuals' rights and freedoms
- controlling access to personal data
- managing processors and other vendors
- training or instructing staff who handle personal data.
The exact documentation required depends on the organization and its processing activities. The important principle is that the store should be able to demonstrate how it complies with the GDPR rather than relying only on statements in a privacy policy.
Reporting personal data breaches
A personal data breach is not limited to a public data leak. It can include accidental destruction, loss, alteration or unauthorized disclosure of, or access to, personal data.
When a breach occurs, the store must assess the risk to individuals' rights and freedoms.
Under Article 33 GDPR, where the breach is likely to result in a risk to individuals' rights and freedoms, the controller must notify the competent supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach.
If the breach is likely to result in a high risk to the rights and freedoms of individuals, the affected people may also need to be informed without undue delay, subject to the conditions and exceptions in the GDPR.
Even when a breach does not require notification to the supervisory authority, the decision and its reasoning should be documented where required by Article 33.
For a store, having an incident-response process in place before a breach occurs is therefore much safer than trying to establish one during an incident.
Most common GDPR mistakes in online stores
Several problems occur repeatedly in eCommerce:
- collecting consent for processing that does not actually require consent;
- bundling different marketing purposes into a single consent;
- making consent easier to give than to withdraw;
- using a privacy policy that does not reflect the store's actual processing;
- activating non-essential tracking before the required consent;
- failing to understand which vendors act as processors;
- overlooking international data transfers;
- keeping unsupported software or modules that create unnecessary security risks;
- failing to maintain a clear process for handling data subject requests;
- failing to assess and document personal data breaches properly.
None of these issues is solved simply by adding a GDPR module or publishing a privacy policy. Compliance depends on the interaction between the legal framework, the store's processes and the actual technical implementation.
Consequences of non-compliance
The GDPR allows supervisory authorities to impose administrative fines of up to €20 million or 4% of the company's total worldwide annual turnover, whichever is higher, for certain infringements.
This is a statutory maximum, not a typical fine for every violation. When determining the appropriate corrective measure and, where applicable, the amount of a fine, supervisory authorities consider factors such as the nature, gravity and duration of the infringement, the number of people affected, the measures taken to mitigate the damage and the organization's degree of cooperation.
For a small or mid-sized store, the practical consequences of poor compliance can therefore extend beyond the fine itself. Responding to an investigation, handling a data breach, rebuilding processes, and losing customer trust can all create high costs.
How to start improving GDPR compliance
The most useful starting point is mapping what personal data the store actually processes: what data it collects, why, on what legal basis, where it is stored, which internal teams and external providers can access it, how long it is retained, what happens when a customer exercises their rights, and what happens if the data is compromised. This exercise alone often reveals gaps that are difficult to see from the storefront.
From there, it is worth addressing the highest-risk issues first - consent and tracking mechanisms, privacy information, access controls, vendor relationships, international transfers, and breach-response procedures. GDPR compliance is then best treated as an ongoing process rather than a one-time project, since new modules, analytics tools, marketing platforms, payment providers, or integrations can change how personal data is processed and may call for the relevant documentation and safeguards to be reviewed again.
Conclusion
Keeping an online store GDPR-compliant is an ongoing task, not something that can be checked off after publishing a privacy policy or adding a consent banner. The first step is knowing what personal data the store handles, why it needs it, and what happens to it throughout its lifecycle. From there, the focus should be on the areas that pose the greatest risk, from consent and tracking to access controls, third-party services and data breaches.
For eCommerce businesses, this also means looking beyond the storefront. The tools and integrations running behind it can affect what data is collected, where it goes and who can access it. Privacy information, consent mechanisms and security controls should therefore reflect how the store actually works, not just what its documentation says.
The legal requirements will vary depending on the business and the way it processes personal data, so more complex questions are best discussed with a qualified data protection professional. On the technical side, an experienced eCommerce team can help review the setup, identify potential gaps and make sure the necessary safeguards are actually in place.
<div class="rtb-text-box is-blue-50">Not sure whether your store's technical setup supports GDPR compliance? We can help identify potential gaps and implement the technical measures needed to keep your store secure and maintainable. Contact us!</div>
Frequently asked questions (FAQ)
Does GDPR apply to a small online store?
Yes. There is no general exemption from GDPR simply because an online store is small. However, some specific GDPR obligations have exceptions or different thresholds. For example, Article 30 provides a limited exemption from the Record of Processing Activities requirement for certain organizations with fewer than 250 employees, subject to additional conditions.
Does an online store always need consent to process customer data?
No. Consent is only one of the GDPR's legal bases. Processing that is necessary to fulfil an order can generally rely on contract performance, while certain record-keeping obligations can rely on a legal obligation. Marketing and tracking activities may involve different legal bases and can also be subject to additional ePrivacy and national-law requirements.
Do all third-party services need a data processing agreement?
No. An Article 28 data processing agreement is required when a third party acts as a processor on behalf of the store. Other providers may act as independent controllers or have another legal role. The store should therefore determine the role of each provider instead of assuming that every vendor requires the same agreement.
What happens if an online store suffers a data breach?
The store needs to assess the breach and determine whether it is likely to pose a risk to individuals' rights and freedoms. If notification to the supervisory authority is required, it generally has to be made without undue delay and, where feasible, within 72 hours of becoming aware of the breach. High-risk breaches can also require communication to affected individuals.
What personal data does an online store need to protect?
An online store may process names, contact details, delivery and billing information, order and account data, IP addresses, device information, and data collected through analytics or marketing tools. Which data is processed and how it should be protected depends on the store's actual activities. The key principles are to collect only the data that is necessary, use it for defined purposes, and implement appropriate safeguards throughout its lifecycle.
