GDPR for Online Stores: A Practical Checklist
An online store handles personal data from the first visit to the last delivery: names, addresses, emails, order histories and payment details. If you sell to customers in the EU, the GDPR applies to all of it, wherever your business is based. This checklist walks through what a small shop needs to have in place, step by step. It is general information, not legal advice, so check the guidance from your data protection authority or a specialist when in doubt.
Key takeaways
- The GDPR applies to shops that sell to people in the EU, even if the shop is based in the UK, the US or elsewhere.
- For every type of customer data, know why you collect it and which lawful basis you rely on.
- Your email, payment, hosting and shipping providers need processor agreements.
- Answer customer data requests within one month, and report serious breaches to the authority within 72 hours where required.
- Collect less, keep it for less time and protect it well. That reduces both risk and work.
Most small store owners meet the GDPR through a cookie banner or a privacy policy template. Those matter, but they are the visible tip. The real work is knowing what data flows through your store, who else touches it and what you will do when a customer asks for a copy or a breach happens.
The good news is that a small online store has a fairly predictable set of data. Once you map it, most of the checklist follows naturally. This guide focuses on the store itself. Cookies get their own article, and privacy policy wording is covered separately on this site.
Does the GDPR apply to your store?
The General Data Protection Regulation, Regulation (EU) 2016/679, covers businesses established in the EU. It also covers businesses outside the EU that offer goods or services to people in the EU or monitor their behavior. Signs that you are offering goods to EU customers include shipping to EU countries, pricing in euros or writing your store in EU languages.
A few points for sellers outside the EU:
- UK sellers follow the UK GDPR at home, which is very similar, and may also fall under the EU GDPR for EU customers.
- Non-EU sellers targeting EU consumers may need to appoint an EU representative under Article 27 of the GDPR. There are limited exceptions, for example for occasional, low-risk processing, so check whether they fit you.
- US sellers also need to consider their own federal and state privacy laws, which work differently.
Maximum fines are rarely the realistic outcome for a small shop, but complaints, investigations and the time spent fixing problems are very real. A tidy setup is the cheapest insurance.
Step 1: Map the data your store handles
Start with a simple inventory. You cannot protect, minimize or explain data you do not know you have. Walk through the customer journey and note each point where personal data is collected or passed on.
| Stage | Typical data | Who else may receive it |
|---|---|---|
| Browsing | IP address, device data, cookie identifiers | Hosting, analytics and advertising tools |
| Account and checkout | Name, email, phone, billing and delivery address | Store platform, payment provider, fraud screening |
| Fulfillment | Name, address, phone, parcel contents | Carriers, fulfillment center, customs brokers |
| Marketing | Email, purchase history, preferences | Email marketing and review tools |
| Support and returns | Messages, order details, photos of products | Help desk software, returns service |
Write this down in a spreadsheet: data type, purpose, where it is stored, who receives it, how long you keep it. Larger organizations keep formal records of processing activities. Even if a small business is partly exempt from that formal duty, the same spreadsheet is the backbone of everything else on this list.
Step 2: Pick a lawful basis for each purpose
The GDPR requires a lawful basis for every processing purpose. For an online store, three come up again and again:
- Contract. Processing needed to take and fulfill an order: name, address, payment and delivery details. You do not need consent to ship a parcel the customer bought.
- Legal obligation. Keeping invoices and tax records for the period your tax law requires.
- Consent or legitimate interests for marketing. Rules on marketing emails also come from national e-privacy laws, which in many EU countries require consent for newsletters, with a narrow exception for similar products to existing customers who were given a clear chance to opt out.
Common mistake
Putting a pre-ticked "sign me up for news and offers" box at checkout, or making newsletter sign-up a condition of buying. Consent must be a clear, active choice, and the customer must be able to buy without giving it. Keep the newsletter box unticked and separate from the order button.
Step 3: Tell customers clearly
Your privacy notice explains, in plain language, what you collect, why, on which lawful basis, who receives it, where it goes, how long you keep it and what rights customers have. It should be easy to find, usually linked in the footer and near the points where you collect data, such as checkout and newsletter forms.
Keep it accurate. A generic template that mentions tools you do not use, or misses the ones you do, is a common weakness. Update it whenever you add a new app, carrier or marketing tool.
Step 4: Sort out your processors
When another company handles personal data on your behalf, it is usually a processor, and the GDPR requires a written agreement with it. For an online store that typically includes your store platform, hosting, email marketing service, help desk, and fulfillment center. Payment providers and carriers may act as processors for some tasks and as independent controllers for others, so read how they describe their role.
- List every app and service. Go through your store's installed apps, your integrations and your monthly invoices. Each one that touches customer data goes on the list.
- Find each data processing agreement. Most established providers publish a DPA that you accept online or that forms part of their terms. Save a copy or a link with the date.
- Check international transfers. If a provider stores or accesses EU customer data outside the EU, the GDPR's transfer rules apply. Providers usually explain which safeguard they rely on.
- Remove what you do not use. Old apps that still have access to your customer list are a needless risk. Uninstall them and revoke their access.
Pro tip
Review your installed apps every quarter. Store platforms make it very easy to add a plugin for a week-long test and forget it is still connected. Each forgotten app is another place your customer data lives.
Step 5: Handle customer rights requests
Customers can ask for a copy of their data, ask you to correct or delete it, object to marketing and more. You generally have one month to respond, which can be extended in some complex cases.
- Have one inbox. Tell customers in your privacy notice where to send requests, such as a privacy email address.
- Verify identity sensibly. Ask for enough to be sure the request is genuine, for example a reply from the email on the account, without demanding excessive documents.
- Know where to look. Your data map from step 1 tells you which systems to search for a copy or a deletion.
- Respect legal limits. You may need to keep invoices for tax purposes even after a deletion request. Explain this to the customer.
Example
Imagine a customer emails a small homeware shop asking to delete all her data. The owner checks the data map: the store platform, the email marketing tool, the help desk and the shipping app. He deletes her marketing profile and support tickets, anonymizes her account, keeps the invoices required for tax and replies within two weeks explaining what was deleted and what must be kept, and for how long.
Step 6: Secure the data and plan for breaches
Security is a GDPR requirement, not just good practice. For a small store, the basics go a long way:
- Use strong, unique passwords and two-factor authentication on your store admin, email and every connected tool.
- Give staff and freelancers their own logins with only the access they need, and remove access when they leave.
- Avoid exporting customer lists to spreadsheets on personal laptops or shared drives unless you need to.
- Let your payment provider handle card details instead of storing them yourself.
- Set retention periods and delete old data, such as abandoned accounts or stale marketing lists.
If a personal data breach happens, for example a hacked admin account or a customer list sent to the wrong person, you may need to notify your data protection authority within 72 hours of becoming aware of it, and in serious cases tell affected customers. Keep an internal record of every breach, even ones you do not need to report.
Your GDPR checklist for an online store
- Map the personal data you collect, where it goes and how long you keep it
- Note the lawful basis for each purpose, such as contract, legal obligation or consent
- Make newsletter sign-up optional, unticked and separate from checkout
- Publish a clear, accurate privacy notice and link it near every data form
- Collect and save data processing agreements from all your providers
- Check whether you need an EU representative if you are based outside the EU
- Set up a privacy inbox and a simple process for rights requests
- Turn on two-factor authentication for every admin and tool
- Set retention periods and delete data you no longer need
- Write a short breach plan with your authority's contact details
Frequently asked questions
Do I need consent to process orders?
Generally no. Processing the data needed to fulfill an order usually relies on the contract basis. Consent is more relevant for things like marketing emails and non-essential cookies.
Can I share customer addresses with my courier?
Yes, sharing the details needed to deliver an order is part of fulfilling the contract. Mention carriers in your privacy notice and share only what they need, such as name, address and a contact number.
I am a US seller with a few EU customers. Does this apply to me?
If you actively offer goods to people in the EU, for example by shipping there and marketing to them, the GDPR can apply. Whether you also need an EU representative depends on your situation. Check the guidance or ask a specialist.
How long can I keep customer data?
Only as long as you need it for the purpose. Invoices must often be kept for the period your tax law sets. Marketing data and inactive accounts should be reviewed and cleared out regularly.
Related reading
The bottom line
GDPR compliance for an online store is mostly good housekeeping: know your data, have a reason for each use, sign agreements with the companies that help you, answer customer requests on time and protect what you hold. A data map and a short checklist cover most of what a small shop needs.
This is general information, and data protection law is applied by national authorities that publish their own guidance. Check the European Commission's GDPR pages, your national data protection authority, or the ICO and GOV.UK for UK sellers, and speak to a specialist for anything unusual.
