How many tools in your online store process customer data? If your answer is “I don’t know exactly,” you have a problem your management team may not know about, but the Polish data protection authority does.
Checkout, customer accounts, newsletters, Meta Pixel, Google Analytics, email platforms, chatbots, couriers, payment providers, CRM systems, heatmaps, and sign-up pop-ups: these are a dozen or more places where your store collects and processes personal data. Each needs its own legal basis and an up-to-date privacy notice. When an outside tool is involved, you may also need a data processing agreement.
Yet in most online stores, the documentation describes a model from two years ago, the privacy policy was copied from another project, and marketing runs on the basis of “this is how it works,” rather than “this is how it should work.” In 2025, the President of Poland’s Personal Data Protection Office (UODO) imposed fines totaling nearly PLN 64.5 million, about a 400% year-over-year increase, and e-commerce was among the sectors prioritized for inspection.
This article explains what data disorder typically looks like in e-commerce, the risks it creates, and how to move from scattered processes to an organized model of personal data protection in e-commerce in four steps, without putting sales or marketing on hold.
Terms to know before you read
Before getting into the details, here are several terms used in this article and their specific legal meanings:
| Term | Meaning in e-commerce |
|---|---|
| Data controller | The entity that decides why and how data is processed. In e-commerce, this is usually the online store owner. |
| Processor | A company that processes data on the controller’s instructions, such as an email platform, courier, or software house. |
| Data processing agreement | An agreement between a controller and a processor that sets the terms for processing data, required by Article 28 GDPR. |
| Profiling | Automated processing used to evaluate personal characteristics, such as product recommendations, segmentation, or personalized prices. |
| Privacy notice obligation | The requirement to tell people who processes their data, why, and on what legal basis. It must be met at every point where data is collected. |
| UODO | Poland’s Personal Data Protection Office, the national supervisory authority enforcing GDPR. |
| PKE | Poland’s Electronic Communications Law, which regulates, among other things, the use of cookies. |
What data disorder looks like in a typical online store
Personal data in e-commerce is not kept in one place. It appears in customer accounts, checkout, newsletters, ad campaigns, tracking pixels, contact forms, vendor integrations, and post-sale support. Each part may rely on a different legal basis, collect different categories of data, and send them to different recipients.
The problem is that different teams are responsible for different parts of the process:
| Team | Data responsibilities | Typical problem |
|---|---|---|
| Marketing | Newsletters, remarketing, pixels, automation | Consent legal bases are not checked; tools are launched without processing agreements. |
| E-commerce / product | Checkout, user accounts, forms | The privacy policy was not updated after a platform change. |
| IT | Integrations, analytics, hosting, tools | No inventory of tools that process customer data. |
| Customer care | Complaints, returns, correspondence | Data is stored without a defined retention period. |
| Management | Formal responsibility for compliance | Management cannot see who makes decisions about data. |
Each team makes local decisions about data without a shared model. Marketing adds an analytics tool. IT integrates another system. Customer care collects information in complaint forms. No one checks whether each action reflects a deliberate decision, current documentation, and a data processing agreement.
The result: the documentation describes a different model from the one actually in use. The privacy policy names three tools while the store uses twelve. Privacy notices were copied from a previous project. Marketing consents do not distinguish between processing purposes.
This is not a theoretical problem. The President of UODO imposed fines totaling more than PLN 11 million on DPD Polska, including PLN 6.251 million for using outside courier services without data processing agreements. For an online store that shares customer data with couriers, payment providers, and marketing tool vendors, this is a direct warning.
Risks that grow with every new campaign and integration
Risk of a mismatch between practice and documentation
This is the most common source of problems during a UODO inspection or after a customer complaint. The privacy policy describes one processing model, but the store operates differently: it uses more tools, collects data at other points, or shares data with other recipients.
The Morele.net case, in which the company was fined more than PLN 3.8 million for inadequate security measures after a breach affecting 2.2 million customers, shows that UODO assesses not only the wording of documents but also whether technical and organizational measures match the actual operating model.
Risk in marketing and profiling
E-commerce marketing moves quickly: new campaigns, automations, and segments. GDPR compliance often fails to keep pace.
Three areas carry the highest risk:
- Remarketing without proper consent. Meta Pixel and Google Ads require consent for analytics and marketing cookies under PKE. A cookie banner that displays information but does not block scripts until consent is given does not meet legal requirements.
- Profiling without a legal basis. Personalized prices, product recommendations based on purchase history, and automatic customer segmentation are profiling under GDPR (Article 4(4)). They require a separate legal basis and customers must be told about their right to object.
- Combining data from different sources. When an e-commerce business combines transaction, behavioral, and marketing data in one ecosystem, it creates mixed data sets. Under the regulation on the free flow of non-personal data, where personal and non-personal data are inextricably linked, GDPR applies to the entire set, even if personal data is only a small part of it.
The EDPB Guidelines 03/2022 on dark patterns identify six categories of deceptive design patterns that may appear in cookie banners and consent interfaces. A UOKiK study found that 75.7% of the websites and apps examined used at least one dark pattern. The most common were preselection, which checks an option for the consumer, and false social proof such as “most popular.”
Risk in relationships with technology vendors
A typical online store uses a dozen or more outside tools: Google Analytics, Meta Pixel, an email platform such as Mailchimp or GetResponse, a CRM, heatmaps such as Hotjar, an e-commerce platform, hosting, a payment provider, a courier, and a software house.
Each tool processes the store’s customer data. Each requires a data processing agreement (Article 28 GDPR). Without one, the store, as controller, bears responsibility for breaches on the vendor’s side.
Another challenge is transfers outside the EEA. The European Commission’s adequacy decision of July 10, 2023, for the EU-US Data Privacy Framework (DPF) simplifies transfers to certified entities in the United States. The EU General Court judgment of September 3, 2025, confirmed the validity of that decision. This means transfers to Google, Meta, or Microsoft, if they are certified under the DPF, may rely on Article 45 GDPR.
But the DPF does not remove the other obligations:
- Consent for analytics and marketing cookies under PKE
- The information obligation under GDPR Articles 13 and 14, including stating that data is transferred to the United States and on what basis
- Checking whether the vendor’s specific entity is actively certified and whether its certification covers that type of data
- A legal basis for processing under GDPR Article 6, independent of the transfer mechanism
Risk of personal liability for management
Management is responsible for an area it may not control operationally. Risk is spread across marketing, e-commerce, IT, customer care, and outside partners, but formal responsibility rests with the data controller. The PLN 5.898 million fine imposed on Glovo (Restaurant Partner Polska) for obtaining users’ ID scans without a legal basis shows that the authority does not distinguish between “marketing configured it that way” and “management knew about it.”
Four steps to organize e-commerce data
Organizing personal data protection in e-commerce does not require stopping sales or rebuilding all of marketing. It does require a systematic approach. These four steps take you from diagnosis to a consistent model.
Step 1: Map every point where data is collected
Start by listing every place where your store collects personal data. For each point, identify:
| Data collection point | Data collected | Legal basis | Is there a privacy notice? |
|---|---|---|---|
| Checkout (order form) | First and last name, address, email, phone | GDPR Article 6(1)(b), performance of a contract | Yes / No / Out of date |
| User account | Registration data, order history | GDPR Article 6(1)(b) | Yes / No / Out of date |
| Newsletter | Email address | Consent (GDPR Article 6(1)(a)) | Yes / No / Out of date |
| Contact form | Name, email, message | GDPR Article 6(1)(f), legitimate interests | Yes / No / Out of date |
| Chatbot | Information provided in the conversation | To be determined | Yes / No / Out of date |
| Sign-up pop-up | Email address | Consent | Yes / No / Out of date |
| Returns / complaints form | Order and contact details | GDPR Article 6(1)(c), legal obligation | Yes / No / Out of date |
Goal: get a complete picture of what actually happens to data in the store. Only after this inventory can you assess whether the documentation reflects reality.
Step 2: Inventory tools and processing agreements
List all outside tools and services that process customer data. For each one, check:
- Is there a data processing agreement (Article 28 GDPR)?
- Is data transferred outside the EEA? If so, on what basis (DPF, standard contractual clauses, or another basis)?
- Does the scope of the agreement match the actual processing?
- Has the vendor implemented appropriate security measures?
If you use US-based tools such as Google Analytics, Meta, Mailchimp, or HubSpot, check whether the vendor’s specific entity is certified under the EU-US Data Privacy Framework. The list of certified entities is public and available on the US Department of Commerce website.
Step 3: Update documentation and consent mechanisms
Based on steps 1 and 2, update:
- Privacy policy, so that it describes how the store actually operates, rather than reusing a template from an earlier project. Identify real processes, tools, and purposes of processing.
- Privacy notices, separately for each data collection point (checkout, account, newsletter, contact form). Each notice must contain the 10 elements required by GDPR, including information about profiling and transfers outside the EEA.
- Cookie consent mechanism: make sure the banner actually blocks scripts until consent is given. Provide an equally prominent option to refuse, and implement a persistent way to reopen the consent panel.
- Marketing consents: separate consent by purpose, including newsletter, remarketing, profiling, and automation. Blanket consent for several purposes at once is not allowed under EDPB Guidelines 05/2020.
Step 4: Set internal rules and an update procedure
- Appoint one person to coordinate personal data matters. This does not have to be a Data Protection Officer (DPO). It can be someone who gathers information from marketing, IT, customer care, and e-commerce.
- Prepare a simple guide for marketing explaining “what is allowed, what is not, and on what basis” for remarketing, segmentation, profiling, and automation.
- Set an update procedure. After every significant change, such as a new integration, marketing channel, or vendor, update the documentation. Otherwise, the privacy policy may stop reflecting reality again within weeks.
- Prepare an incident response procedure: who responds, how quickly, what steps they take, and when they escalate to a lawyer. A breach must be reported to UODO within 72 hours of discovery (GDPR Article 33). Toyota Bank Polska was fined PLN 78,000 for exceeding this deadline.
- Provide a short training session for marketing, customer care, and e-commerce teams. Focus on rules for their everyday work, not GDPR theory.
UODO is watching e-commerce: sector inspection plans
In its 2025 sector inspection plan, the President of UODO expressly named e-commerce as one of the priority areas for supervision. The authority also included sectors related to online commerce in earlier plans for 2022 and 2026.
UODO does not publish an official e-commerce inspection “scenario,” but its past decisions and reports indicate the areas it is likely to check first:
| Inspection area | What UODO looks at | Example sanction |
|---|---|---|
| Data security (GDPR Article 32) | Whether technical and organizational measures fit the scale and nature of processing | Morele.net: more than PLN 3.8 million |
| Processing agreements (GDPR Article 28) | Whether the controller has agreements with all processors | DPD Polska: PLN 6.251 million |
| Data minimization (GDPR Article 5(1)(c)) | Whether the data collected is proportionate to the purpose | Glovo: PLN 5.898 million |
| Breach reporting (GDPR Article 33) | Whether a breach was reported within 72 hours | Toyota Bank: PLN 78,000 |
| Processing transparency | Whether information given to customers matches actual processes | Vinted: more than EUR 2.3 million (Lithuanian authority) |
In 2024, UODO received 8,056 complaints and 14,842 breach notifications. In 2025, complaints increased to about 12,986, and breach notifications to 22,435. An inspection does not have to start with the authority: a customer complaint may be enough for UODO to examine the store’s entire data processing model.
Remember the additional obligations under the Digital Services Act (DSA), which has applied in full since February 17, 2024. Article 25 DSA prohibits designing interfaces in a way that manipulates or otherwise impairs users’ ability to make free decisions. For marketplaces and sales platforms, this adds another regulatory layer alongside GDPR.
How we can help organize personal data in your e-commerce business
Organizing data protection in an online store is not a one-off privacy policy update. It means reviewing the whole model, from data collection points and marketing and analytics tools to relationships with technology vendors.
Our support includes:
- Data processing audit: map every collection point, inventory tools, and check processing agreements and consent mechanisms.
- Risk and recommendation report: identify areas that need correction, assess risk, and estimate possible consequences.
- Documentation updates: privacy policy, privacy notices, processing agreements, and cookie terms matched to the store’s actual operating model.
- Marketing rules: a guide to what is allowed, what is not, and on what basis for remarketing, profiling, automation, and segmentation.
- Team training: practical data handling rules for marketing, customer care, and e-commerce.
- Ongoing support: monitor regulatory changes, update documents when the business model changes, and support you during incidents.
We work with e-commerce, SaaS, and digital platforms. We understand rapid launches, parallel integrations, and pressure to deliver marketing results. We design solutions that organize risk without blocking sales or user experience.
Organize your data before it starts costing you
Personal data protection in e-commerce is not a one-time document. It is a model that must keep pace with the business, including new tools, campaigns, integrations, and sales channels.
UODO fines are increasing (PLN 64.5 million in 2025), e-commerce is among the priority inspection sectors, and one customer complaint can trigger a review of the entire data processing model. At the same time, the right to data protection is not absolute. The goal is not to ban data collection but to organize processes so processing is proportionate, justified, and transparent.
If you do not know how many tools in your store process customer data, where to start, or whether your documentation reflects reality, contact us. We will show you the most important gaps and help close them.
Frequently asked questions
How can I tell whether my online store complies with GDPR if someone else wrote the privacy policy two years ago?
GDPR compliance does not depend on who wrote the privacy policy. It depends on whether the policy describes how the store actually operates. If you have changed platforms, added marketing tools or integrations, or changed how you serve customers since it was written, the documentation probably no longer reflects reality. Compare the policy with what happens in the store. If you find a mismatch, update the documentation or commission an audit.
Can I legally run remarketing through Meta Pixel and Google Ads without the user’s explicit consent?
No. Meta Pixel and Google Ads rely on marketing cookies, which require the user’s prior consent under Poland’s Electronic Communications Law. The cookie banner must actually block scripts until consent is given; displaying information is not enough. After consent to cookies, you also need a legal basis for processing under GDPR Article 6. Transfers to Meta and Google in the United States may rely on the EU-US Data Privacy Framework, provided you verify the certification of the vendor’s specific entity.
What could happen if I do not have processing agreements with vendors whose tools I have used for years?
Without a data processing agreement (GDPR Article 28), responsibility for breaches on the vendor’s side rests with you as controller. DPD Polska was fined PLN 6.251 million for using outside couriers without these agreements. Fortum Marketing and Sales Polska was fined PLN 4.9 million, in part for failing to verify a processor. Inventory all your tools and check whether an agreement exists for each one and whether it matches the actual processing.
Who in the company should be responsible for personal data: me as CEO, marketing, IT, or should I hire a DPO?
Formally, responsibility rests with the data controller, meaning your company, and management is responsible for the company. Not every e-commerce business must appoint a Data Protection Officer (DPO), but each should have one person coordinating personal data matters across the organization. That person gathers information from marketing, IT, customer care, and e-commerce, keeps documentation current, and escalates problems. Without this coordination, each team makes separate data decisions and no one has the full picture.
Do I need to update documentation every time I add a new marketing tool?
Yes, if the new tool processes customers’ personal data, as almost every e-commerce tool does. GDPR requires documentation to reflect the current state of processing. A new tool means a new processing point, potentially a new recipient, and a new legal basis. Without updates to the privacy policy, notices, and record of processing activities, your documentation starts to drift from reality. That is one of the most common sources of problems during a UODO inspection or after a customer complaint.
If a customer complains to UODO, will the authority review my whole data processing model or only that one point?
UODO may limit its review to the specific complaint, but it may also expand the investigation if it finds other irregularities. The Morele.net case began with a data leak, but the authority assessed the entire security model, both technical and organizational. Treat any complaint as a possible entry point for broader scrutiny and make sure your overall data protection model is consistent, rather than focusing on just one element.
