How many tools in your online store process customer data? If your answer is \u201cI don\u2019t know exactly,\u201d you have a problem your management team may not know about, but the Polish data protection authority does.<\/p>\n
Checkout, customer accounts, newsletters, Meta Pixel, Google Analytics, email platforms, chatbots, couriers, payment providers, CRM systems, heatmaps, and sign-up pop-ups: these are a dozen or more places where your store collects and processes personal data. Each needs its own legal basis and an up-to-date privacy notice. When an outside tool is involved, you may also need a data processing agreement.<\/p>\n
Yet in most online stores, the documentation describes a model from two years ago, the privacy policy was copied from another project, and marketing runs on the basis of \u201cthis is how it works,\u201d rather than \u201cthis is how it should work.\u201d In 2025, the President of Poland\u2019s Personal Data Protection Office (UODO) imposed fines totaling nearly PLN 64.5 million, about a 400% year-over-year increase, and e-commerce was among the sectors prioritized for inspection<\/strong>.<\/p>\n This article explains what data disorder typically looks like in e-commerce, the risks it creates, and how to move from scattered processes to an organized model of personal data protection in e-commerce<\/strong> in four steps, without putting sales or marketing on hold.<\/p>\n Before getting into the details, here are several terms used in this article and their specific legal meanings:<\/p>\n Personal data in e-commerce is not kept in one place. It appears in customer accounts, checkout, newsletters, ad campaigns, tracking pixels, contact forms, vendor integrations, and post-sale support. Each part may rely on a different legal basis, collect different categories of data, and send them to different recipients.<\/p>\n The problem is that different teams are responsible for different parts of the process:<\/p>\n Each team makes local decisions about data without a shared model. Marketing adds an analytics tool. IT integrates another system. Customer care collects information in complaint forms. No one checks whether each action reflects a deliberate decision, current documentation, and a data processing agreement.<\/p>\n The result: the documentation describes a different model from the one actually in use<\/strong>. The privacy policy names three tools while the store uses twelve. Privacy notices were copied from a previous project. Marketing consents do not distinguish between processing purposes.<\/p>\n This is not a theoretical problem. The President of UODO imposed fines totaling more than PLN 11 million on DPD Polska, including PLN 6.251 million for using outside courier services without data processing agreements<\/strong>. For an online store that shares customer data with couriers, payment providers, and marketing tool vendors, this is a direct warning.<\/p>\nTerms to know before you read<\/h2>\n
\n\n
\n \nTerm<\/th>\n Meaning in e-commerce<\/th>\n<\/tr>\n<\/thead>\n \n Data controller<\/strong><\/td>\n The entity that decides why and how data is processed. In e-commerce, this is usually the online store owner.<\/td>\n<\/tr>\n \n Processor<\/strong><\/td>\n A company that processes data on the controller\u2019s instructions, such as an email platform, courier, or software house.<\/td>\n<\/tr>\n \n Data processing agreement<\/strong><\/td>\n An agreement between a controller and a processor that sets the terms for processing data, required by Article 28 GDPR.<\/td>\n<\/tr>\n \n Profiling<\/strong><\/td>\n Automated processing used to evaluate personal characteristics, such as product recommendations, segmentation, or personalized prices.<\/td>\n<\/tr>\n \n Privacy notice obligation<\/strong><\/td>\n The requirement to tell people who processes their data, why, and on what legal basis. It must be met at every point where data is collected.<\/td>\n<\/tr>\n \n UODO<\/strong><\/td>\n Poland\u2019s Personal Data Protection Office, the national supervisory authority enforcing GDPR.<\/td>\n<\/tr>\n \n PKE<\/strong><\/td>\n Poland\u2019s Electronic Communications Law, which regulates, among other things, the use of cookies.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n What data disorder looks like in a typical online store<\/h2>\n
\n\n
\n \nTeam<\/th>\n Data responsibilities<\/th>\n Typical problem<\/th>\n<\/tr>\n<\/thead>\n \n Marketing<\/td>\n Newsletters, remarketing, pixels, automation<\/td>\n Consent legal bases are not checked; tools are launched without processing agreements.<\/td>\n<\/tr>\n \n E-commerce \/ product<\/td>\n Checkout, user accounts, forms<\/td>\n The privacy policy was not updated after a platform change.<\/td>\n<\/tr>\n \n IT<\/td>\n Integrations, analytics, hosting, tools<\/td>\n No inventory of tools that process customer data.<\/td>\n<\/tr>\n \n Customer care<\/td>\n Complaints, returns, correspondence<\/td>\n Data is stored without a defined retention period.<\/td>\n<\/tr>\n \n Management<\/td>\n Formal responsibility for compliance<\/td>\n Management cannot see who makes decisions about data.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n