GDPR for Online Stores: A Practical Checklist (Not a Legal Essay)

For a normal online store, GDPR compliance comes down to six things: collect only what you need, have a lawful basis for using it, tell people what you do in plain language, get real consent for cookies and marketing, keep data only as long as you need it, and be able to delete it on request. Most stores are 80% compliant already and fail on the same two points: cookie banners and marketing consent.

The six practical obligations

1. Collect only what you need

Name, delivery address, phone, email fulfil an order. Date of birth, gender and "how did you hear about us" as required fields do not. Every extra required field is both a compliance liability and a conversion loss.

2. Have a lawful basis

For order fulfilment, that is contract performance — you do not need consent to process an address you need to ship to. For marketing to consumers, you generally need consent: freely given, specific, informed, and unambiguous. That rules out pre-ticked boxes and bundling marketing consent into the terms acceptance.

3. Publish a real privacy policy

Written for humans: what you collect, why, on what basis, how long you keep it, who you share it with (including processors outside the EU), and how to exercise rights. A generic copied template that names the wrong company is worse than none.

4. Cookie consent that actually allows refusal

This is the most commonly enforced failure. A compliant banner:

• Loads no non-essential cookies or trackers before consent — including analytics and advertising pixels.
• Makes refusing as easy as accepting. "Accept all" with the refusal buried two menus deep is not compliant.
• Lets people change their mind later.

If you run advertising pixels, they must wait for consent.

5. Retention

Decide how long you keep what, and say so. Order records typically need to be kept for accounting and tax purposes for a defined period; marketing lists do not. "Forever" is not a retention policy.

6. Be able to act on rights requests

Access, correction, deletion, portability, objection. In practice you need to know where the data lives — store, email platform, analytics, support tool, accounting — and be able to act across all of them within the statutory deadline.

Processors: the part stores forget

Every tool that touches customer data is a processor: your store platform, email marketing tool, analytics, support chat, payment provider, shipping software. For each you need an agreement covering data processing, and awareness of where the data is stored. Keep a simple list — one row per tool, what data it sees, where it is hosted. That list is most of your documentation.

What GDPR does not require

• It does not require a cookie banner if you use no non-essential cookies.
• It does not prevent you from marketing to existing customers about similar products in every case — some jurisdictions allow a soft opt-in for existing customers. Check locally.
• It does not require EU hosting. It requires appropriate safeguards for transfers.

A one-hour version

1. Delete the optional required fields from your checkout.
2. Rewrite your privacy policy so it describes what you actually do.
3. Fix the cookie banner so refusal is one click and nothing loads before consent.
4. Separate marketing consent from terms acceptance, untick it by default.
5. List every tool holding customer data.
6. Write down retention periods.

That covers the large majority of real risk for a small store.

Frequently asked questions

Does GDPR apply if I am outside the EU?

Yes, if you offer goods or services to people in the EU. Selling into the EU brings you into scope.

Do I need a Data Protection Officer?

Most small stores do not. The requirement is triggered by specific circumstances such as large-scale monitoring or sensitive data processing.

What about a customer asking me to delete their data?

Honour it, but note that records you must keep for legal or tax reasons — like invoices — can generally be retained on that basis. Delete the marketing profile, keep the statutory records.

Is analytics allowed?

Yes, with consent, and with configuration that respects it. Analytics that loads before consent is the most common violation on small stores.

General guidance, not legal advice.

Open a store with the privacy basics built in — free, no commission.