GDPR for Online Stores: What EU and UK Rules Require

The GDPR, the European Union's General Data Protection Regulation, sets rules for how businesses collect and use personal data about people in the EU, and the UK applies an almost identical version known as the UK GDPR. For online stores, it affects nearly everything: checkout forms, customer accounts, marketing emails, analytics, cookies, suppliers and what happens when something goes wrong.

It applies not only to businesses based in Europe but also to stores elsewhere that offer goods or services to people in the EU or UK. The core idea is simple: collect only what you need, have a lawful reason for each use, be open about it, keep it safe and respect people's rights. This guide explains those requirements in plain language. It is general information, not legal advice, so confirm your obligations with a qualified adviser.

We first published this article in 2021. This version has been rewritten to focus on what the rules require of online stores today.

Does the GDPR apply to your store?

The GDPR applies to businesses established in the EU, and also to businesses outside the EU that offer goods or services to people in the EU or monitor their behaviour there, for example through tracking for advertising. The UK GDPR works the same way for people in the UK. The European Commission's overview of EU data protection rules and the UK Information Commissioner's UK GDPR guidance are the best official starting points.

• Likely to apply: your store ships to EU or UK addresses, prices in euros or pounds, offers EU languages or targets advertising there.
• Less likely to apply: an occasional EU visitor buys from a store clearly aimed at another market.
• Representative: businesses outside the EU that are covered by the GDPR may need to appoint a representative in the EU, and similarly in the UK, unless an exception applies.

If you sell actively into Europe, assume the rules apply and plan accordingly. Our guide to selling online in Europe covers VAT and consumer law alongside data protection.

The six lawful bases

Under the GDPR, every use of personal data must rest on a lawful basis. Choose the right one for each purpose, record it and explain it in your privacy notice.

Consent has strict conditions: it must be freely given, specific, informed and unambiguous, and as easy to withdraw as to give. Pre-ticked boxes and bundled consent hidden in terms and conditions do not count. Marketing emails and cookies are also governed by separate electronic communications rules in the EU and UK, which our guide to privacy compliance for online stores explains.

Customers' rights

People have several rights over their personal data. Online stores receive these requests more often than many owners expect, usually phrased informally in an email or support chat.

• Access: a copy of the data you hold about them and how you use it.
• Rectification: correction of inaccurate or incomplete data.
• Erasure: deletion in many circumstances, though you may keep what the law requires, such as invoices.
• Restriction: pausing use of data while a complaint is resolved.
• Portability: receiving their data in a commonly used format.
• Objection: stopping use of their data for direct marketing at any time, and in some other cases.

Responses are generally due within one month, extendable in some complex cases. Build a simple procedure: recognise the request, verify identity proportionately, search every system, respond and record what you did. Systems such as Magento, email platforms and helpdesks all hold personal data, so the search must cover them all, including exports and spreadsheets saved by staff.

Data breaches

A personal data breach is any security incident that leads to personal data being lost, destroyed, changed or disclosed without authorisation. For an online store, that might be a hacked admin account, card-skimming code injected into checkout, a misconfigured backup left public or an email sent to the wrong customers.

1. Contain the breach and preserve evidence, such as logs and copies of altered files.
2. Assess the risk to the people affected and what data was involved.
3. Notify the supervisory authority within 72 hours of becoming aware, where the breach is likely to pose a risk to people's rights and freedoms.
4. Tell affected customers without undue delay if the risk to them is high, explaining what happened and what they should do.
5. Record every breach, including ones you decide not to report, with your reasoning.

Prevention is far cheaper. Keep the platform and extensions patched, protect admin accounts with two-factor authentication and monitor for unexpected changes to files, especially checkout. Our e-commerce security checklist lists the essentials.

Transfers outside Europe

Personal data leaving the EU or UK must stay protected. Transfers are allowed to countries with an adequacy decision, or with safeguards such as standard contractual clauses. Many online stores transfer data without realising it, through hosting, email platforms, analytics, support tools or development agencies abroad.

• List every supplier that stores or accesses customer data, and where.
• Check whether each destination has an adequacy decision; India, for example, does not currently have one from the EU.
• Use standard contractual clauses or another valid mechanism where needed, usually through the supplier's data processing agreement.
• Limit what suppliers can see, for example by giving developers anonymised data for testing.
• Mention transfers in your privacy notice, so customers know where their data may be processed.

Accountability: showing your work

The GDPR expects businesses to be able to demonstrate compliance, not just to comply. For most online stores, that means a handful of documents kept up to date.

• Records of processing: what data you hold, why, on what basis, who receives it and how long you keep it.
• Privacy notice: clear, accurate and easy to find.
• Data processing agreements with suppliers that handle data for you.
• Retention rules: how long each type of data is kept and how it is deleted.
• Policies for rights requests and breaches.

Larger organisations, or those processing sensitive data at scale, may also need a data protection officer or impact assessments for high-risk processing.

These documents do not need to be long or legalistic. A clear spreadsheet for records of processing and a few one-page procedures are enough for many small stores. What matters is that they are accurate, that someone owns them and that they are updated when the business changes, for example when you add a new marketing tool or start selling in a new country.

Building GDPR into store features

Many GDPR obligations are easier to meet when the store itself supports them. When building or improving a store, ask your developers to include a few privacy-friendly features from the start.

• Minimal forms: ask only for the fields needed to deliver the order, and make extras clearly optional.
• Guest checkout: let customers buy without creating an account, which reduces the data you hold.
• Separate marketing choices: unticked consent boxes, recorded with a timestamp and the wording shown.
• Account tools: ways for customers to update details, download their data or request deletion.
• Retention jobs: scheduled tasks that remove abandoned baskets, old guest data and inactive accounts according to your rules.
• Access controls: admin roles that limit who can see or export customer data.

These features also improve the shopping experience. Shorter forms convert better, and customers who feel in control of their data are more willing to share it.

Penalties and enforcement

Regulators can issue warnings, orders and fines. The highest fines under the GDPR can reach up to €20 million or 4% of worldwide annual turnover, whichever is higher, with similar limits in sterling under the UK GDPR. In practice, regulators usually focus on serious, careless or repeated failings, and most cases start with a complaint from a customer. The bigger everyday risk for a small store is lost trust when customers feel their data is handled carelessly. A clear privacy notice, prompt answers to requests and visible security measures reassure customers long before any regulator becomes involved.

A GDPR checklist for online stores

1. Map the personal data you collect, where it is stored and who can access it.
2. Choose and record a lawful basis for each purpose.
3. Update the privacy notice and link it from checkout, account sign-up and newsletter forms.
4. Collect marketing consent separately and keep records of it.
5. Set retention periods and delete data you no longer need, including old backups and exports.
6. Sign data processing agreements with suppliers and check transfer safeguards.
7. Write simple procedures for rights requests and breaches.
8. Review the list every year, and whenever you add a new tool. Our guide to e-commerce email marketing covers consent for newsletters.

Frequently asked questions

Selling to customers in Europe and want your store built with data protection in mind? Talk to our team about consent, data handling and secure set-up.