Ecommerce businesses cannot survive without personal data, which means that they must be GDPR compliant. But what does that mean?

In this article, we’ll talk about why GDPR is important for ecommerce businesses, what the requirements are and some practical steps you can take to stay compliant.

Why Is GDPR Critical in Ecommerce?

Whether it’s account information, taking payment or marketing to them, your customers’ data is everything to a business that operates online. That’s why GDPR is so critical – your business is built on data. 

GDPR impacts businesses that handle personal data of UK citizens or residents. So if you’re not compliant, then you run the risk of fines and loss of customer trust. 

Core GDPR Requirements Every Ecommerce Business Must Address

Lawful Basis for Processing

You must have a lawful basis for processing personal data. Lawful bases that are most commonly used in ecommerce include:

• Consent: You need to have explicit consent from the individual before you can do anything with their information, like using cookies to track behaviour.
• Contractual necessity: Processing data is necessary to fulfil the contract with the individual, for example, processing payment or shipping an order. 

There are other lawful bases for processing data, like legal obligation and legitimate interest, but they are not usually needed for ecommerce businesses. 

On explicit consent, GDPR requires businesses to get informed consent from customers before collecting data. They must understand what it is for, which means that you need to obtain separate consent for each purpose, i.e. email marketing, order processing, etc.

Transparent Privacy Information

You must be transparent about collecting, using and protecting personal data. For ecommerce businesses, that usually comes in the form of a privacy policy. This tells your customers or subscribers what you will do with their data, how long you will keep it and gives them the option to opt out of the collection and use of their information. 

This policy needs to be easily accessible on your website, and should include:

• The types of data you’re collecting and why
• How you’re collecting and using this data
• Who has access to the data, and who you share it with
• Whether you use cookies or other technologies
• What rights the customer has and how they can exercise them
• How customers can opt out of data collection and use
• How long you store data and how it’s protected
• Contact details so customers can get in touch with any questions or concerns

Consent & Cookies

If you use cookies to track user behaviour and serve advertising, you must obtain consent before setting them. You must provide clear, transparent information about their cookies and offer granular choices to users for accepting or rejecting non-essential ones – you must make it easy to withdraw consent at any time. 

You should also make sure that you have a more detailed cookie policy available (similar in scope to the privacy policy) to people who want to know more. Get more in-depth information on cookie compliance in our blog post. 

Data Minimisation & Retention

Data minimisation and retention are core principles of UK GDPR, requiring businesses to collect and store the minimum amount of personal data, and deleting it when it’s no longer needed. 

• Data minimisation means limiting data collection to what is adequate, relevant and necessary to fulfil the intended purpose. 
• Data retention means that personal data must not be kept longer than necessary. For example, customer names and addresses can be retained as long as the customer has an active account. Having a clear retention schedule makes this easier.
  

Data Subject Rights

Individuals have a legal right to ask companies to provide a copy of their personal data, known as a SAR or DSAR (Data Subject Access Request). 

As an ecommerce company, you need to respond within the timeline of one month, providing the personal data as well as things like how the data is used and how long it will be stored.

Practical Steps E-Commerce Businesses Can Take Toward Compliance

There are a number of practical ways you can make sure your company complies with GDPR:

• Conduct a data audit and map customer data flows
• Implement consent management solutions
• Training staff on awareness and security best practices
• Regular updates to privacy documentation

Need Help Becoming Fully GDPR Compliant? 

It’s easy to see GDPR as just rules and regulations you have to follow, but it’s also an opportunity to strengthen customer trust and streamline your data practices. 

Our data protection consultants can carry out a GDPR audit to see how compliant you are and where you might be able to improve. Get in touch today.