GDPR in the E-commerce Industry

Do you run an online store? You process data about customers, business partners and employees. The GDPR gives you specific duties, from collecting consent and keeping documentation to reporting breaches within 72 hours. Penalties for violations can reach EUR 20 million or 4% of annual turnover. This guide covers the requirements, an implementation plan and practices that can help you comply without stopping your business.

Why the GDPR applies to every e-commerce business

An online store collects data with every order, account registration, newsletter subscription and customer-service contact. This means you are a personal data controller and are responsible for how the data is processed.

Consumers are becoming more aware. Customers review privacy policies, request data deletion and file complaints with Poland’s Personal Data Protection Office (UODO). If your processes are not in order, you risk not only a financial penalty but also losing customers.

Consent to data processing: how to collect it correctly

Consent is one of the legal bases for processing data under the GDPR. To be valid, it must meet specific conditions:

• Unambiguous: the user actively checks a box or clicks a button. Pre-checked boxes and silent acceptance do not work.
• Informed: before giving consent, the user must know what they are agreeing to, including the purpose, scope and controller.
• Freely given: you cannot make fulfilling an order conditional on consent to marketing.
• Withdrawable: the user must have a simple way to withdraw consent at any time, such as through a link in an email footer or account settings.

Decision rule: If you collect consent for more than one purpose, such as fulfilling an order, sending a newsletter and profiling, each purpose needs a separate checkbox.

Providing information: what you must tell people and whom to inform

The duty to provide information applies not only to customers. It covers every person whose data you process, including suppliers, business partners, employees and contractors.

As the controller, you must inform these people about:

1. The controller’s identity: the company name and contact details.
2. The data protection officer (DPO): if you appointed one, or are required to appoint one, provide the contact details.
3. The purposes and legal basis for processing, such as performing a contract, consent or legitimate interests.
4. How long data is stored: give a specific period or the criteria used to determine it.
5. Data recipients: hosting companies, payment systems, couriers and analytics tools, meaning each entity that processes your users’ data.
6. Transfers of data outside the European Economic Area (EEA), for example if you use services from US providers such as Google Analytics or Mailchimp.
7. Automated decision-making and profiling, if you use algorithms that affect an offer or the terms presented to a user.
8. The data subject’s rights: provide the full list of rights covered in the next section.
9. The right to complain: explain that a person can contact UODO.
10. Whether providing data is voluntary or required, and the consequences of not providing it.
11. The source of the data, if you obtained it indirectly, for example from a business partner.

What to do: Prepare a privacy notice and display it where people can see it, next to the order, registration and contact forms. Prepare separate notices for employees and business partners. See how to prepare an information notice.

User rights: which requests you must be ready to handle

The GDPR gives people whose data you process five rights that you must be able to fulfill:

• Right of access: a user can ask what data you process about them and request a copy.
• Right to erasure, or “right to be forgotten”: if data is no longer needed for the purpose for which you collected it, a user may request its deletion.
• Right to rectification: if a user says their data is inaccurate, you must correct it.
• Right to restriction of processing: in certain situations, such as a dispute about data accuracy, a user may request that processing be “frozen.”
• Right to data portability: a user may request their data in a format suitable for transfer to another controller, such as a CSV or JSON file.

What to implement: Prepare a request-handling procedure covering who receives requests, the response deadline of no more than 30 days and how you verify the requester’s identity. See the guide to a request-handling procedure.

Data security and breach reporting

Security measures to implement

The GDPR does not prescribe specific tools, but it requires safeguards proportionate to risk. In practice, e-commerce needs at least:

• data encryption, including SSL/TLS on the website and database encryption;
• multifactor authentication (MFA) for the administration panel;
• regular backups and tested recovery procedures;
• restricted data access, limited to people who actually need it;
• team training so employees and subcontractors know how to handle data.

Breach-reporting procedure

If a personal data breach occurs, such as a leak, unauthorized access or data loss:

1. Report the incident to UODO: you have 72 hours from detection.
2. Assess the risk to the people affected: if the risk to their rights is high, you must also inform them.
3. Take remedial action: remove the cause, limit the effects and document what happened.

What UODO looks at: Whether the report was timely, communication was transparent and remedial action was reliable. These three factors affect the assessment of the case and the amount of any penalty. A prompt response can limit financial and reputational losses.

How to implement the GDPR in e-commerce: a three-step plan

Step 1: Audit your data

Start by reviewing what you already have. An audit answers these questions:

• What personal data do you collect, and for what purpose?
• Who can access it?
• How long do you store it?
• Where is it stored, such as on servers, in the cloud or in external tools?
• What risks arise from your current processing practices?

An audit will identify gaps and areas of non-compliance. Repeat it regularly, at least once a year. Read more about how an audit identifies gaps and non-compliance.

Step 2: Documentation

Prepare and implement a set of documents:

• Personal data protection policy: internal data-processing rules.
• Privacy notices: separate notices for customers, employees and business partners.
• Record of processing activities: a required register of all processing activities.
• Record of categories of processing activities: if you act as a processor.
• Data processing agreements: with every provider that processes data on your behalf, including hosting, payment and marketing tools.
• Breach-handling procedure: step by step, who reports to whom and by when.
• Procedure for handling individual rights: how you respond to requests for access, deletion and data portability.

Step 3: Technical and organizational measures

Choose safeguards proportionate to the scale of your business and the type of data:

• encryption of data in transit and at rest;
• strong passwords and MFA for accounts with data access;
• backups with regular recovery tests;
• access restrictions based on least privilege;
• training for the entire team, not only IT.

The GDPR and technology: CRM, AI and Big Data

CRM systems and marketing automation

If you use a CRM, marketing automation or analytics tools, check:

• Do you have a valid legal basis for each data-processing activity in these systems?
• Can users easily manage their consent, including withdrawing it or changing its scope?
• Can the system export and delete data when a user requests it?

AI and Big Data: opportunities and risks

AI algorithms and analysis of large datasets can personalize offers and optimize processes. They also create additional duties:

• Transparency: you must be able to explain to users how profiling works and what effects it has for them.
• No discrimination: your algorithms must not lead to unfair differences in the offers presented.
• Right to object: a user may object to automated profiling. You need a way to handle such requests.

If you use AI to analyze data-protection risks, you may identify threats and respond to incidents sooner. This can benefit your operations and your dealings with UODO.

The GDPR and e-commerce marketing

Email marketing

Sending marketing emails requires the recipient’s express consent. In practice:

• Use double opt-in: the user confirms the subscription by clicking a link in a verification email.
• Keep proof of consent, including the date, consent wording and IP address.
• Include a visible unsubscribe link in every email.

Personalization and profiling

If you personalize offers based on user behavior, such as purchase history or viewed products:

• Explain this in the privacy notice.
• Give users the ability to turn profiling off.
• If profiling leads to automated decisions, such as an individual price or refusal of a service, the user may request human intervention.

GDPR penalties: what is at risk?

Failure to comply with the GDPR can have specific financial consequences:

Penalties apply to any entity processing personal data in the course of business, including online stores, marketplace platforms, SaaS companies and any other online business.

Decision rule: If you do not have GDPR documentation, a breach-handling procedure and a way to fulfill user rights, plan an audit and implementation before an inspection or incident occurs. Organizing your processes always costs less than a penalty and damage to your reputation.

Frequently asked questions

What GDPR duties must an online store implement to avoid penalties and loss of customer trust? An online store must collect valid consent for processing, provide privacy notices at every form, establish a procedure for handling user requests for access, deletion and data portability, maintain internal documentation such as a record of processing activities, data processing agreements and a personal data protection policy, and use appropriate technical measures such as encryption, MFA, backups and access restrictions. Missing these elements creates a risk of a penalty of up to EUR 20 million or 4% of annual turnover. Organizing processes costs less than a penalty and reputational loss.

How should an e-commerce business collect valid marketing consent under the GDPR? Consent must be unambiguous, through an active action such as checking a box; informed, so the user knows what they agree to; freely given, meaning an order cannot be conditional on marketing consent; and easy to withdraw, for example through a link in an email footer. If you request consent for more than one purpose, such as a newsletter and profiling, each purpose needs its own checkbox. For email marketing, use double opt-in and keep proof of consent, including the date, wording and IP address.

What must a GDPR privacy notice for an online store contain? It must state the controller’s identity and contact details; DPO details, if one is appointed; the purposes and legal basis for processing; the storage period; data recipients such as hosting, payment, courier and analytics providers; transfers outside the EEA; profiling and automated decision-making; the data subject’s rights; the right to complain to UODO; whether providing data is voluntary or required; and the source of data obtained indirectly. Display it next to order, registration and contact forms, and prepare separate notices for employees and business partners.

Which user rights must an e-commerce business handle under the GDPR, and by when? An e-commerce business must handle five rights: access to data and a copy; erasure, or the right to be forgotten; rectification of inaccurate data; restriction of processing; and data portability in a format suitable for transfer to another controller, such as CSV or JSON. You have no more than 30 days to respond to each request. Prepare a procedure that specifies who receives requests, how you verify the requester’s identity and how you document the response.

What should an e-commerce business do after a data breach, and when must it report it to UODO? You have 72 hours from detecting a personal data breach, such as a leak, unauthorized access or data loss, to report the incident to UODO. If the risk to the rights of the people affected is high, you must also inform them. At the same time, take remedial action: remove the cause, limit the effects and document the incident. UODO looks at timely reporting, transparent communication and reliable remediation, which affect the assessment and any penalty.