Ecommerce and GDPR: obligations, fines and how to comply in your online store
If you run an online store or sell over the internet, the General Data Protection Regulation (GDPR) requires you to process your customers’ personal data with transparency, a valid legal basis and appropriate security. Non-compliance can lead to significant fines from the Spanish Data Protection Agency (AEPD) and other European supervisory authorities. This article covers key GDPR obligations for ecommerce: legal bases and consent, privacy policy, cookies and records of processing activities, plus the risks and common errors that often result in fines.
In short
- You must provide clear information to users (privacy policy) and have a legal basis for each processing operation (contract, consent, legitimate interest).
- Consent must be free, specific, informed and unambiguous; pre-ticked boxes are not valid.
- Non-essential cookies require prior consent; the banner must allow accept or reject by category.
- Fines for non-compliance can go up to €20 million or 4% of global annual turnover.
- You must keep a record of processing activities and implement appropriate technical and organisational measures.
Legal bases and consent in ecommerce
In an online store you process personal data for orders, shipping, invoicing, customer support and often marketing (newsletters, remarketing). Each processing must have a legal basis under the GDPR: performance of contract (order, delivery), legal obligation (invoicing, tax retention) or consent (newsletter, non-essential cookies, profiling). Consent must be free, specific, informed and unambiguous. Pre-ticked boxes, illegible text or “bundled” consent without distinguishing purposes are not valid and can be penalised.
Good practice: Separate consent for the purchase (necessary for the contract) from consent for marketing communications. Use unchecked boxes by default and clear links to the privacy policy before collecting consent.
Information to users: privacy policy (Arts. 13 and 14 GDPR)
You must inform data subjects clearly and accessibly about: who is the controller, what data is collected, for what purposes, on what legal basis, how long it is kept, what rights they have (access, rectification, erasure, restriction, portability, objection and not to be subject to automated decisions), whether there are international transfers and the right to complain to a supervisory authority. This is typically set out in the privacy policy, which must be available before users provide data. GDPR advisory can help you draft it and align your records and processes.
Fines: what happens if you don’t comply
Important: GDPR breaches can be fined up to €20 million or 4% of worldwide annual turnover of the previous financial year (whichever is higher). The AEPD and other European authorities impose fines for: unclear information, invalid consent (pre-ticked boxes, single consent for everything), cookies placed without prior consent, missing or inadequate records of processing, security breaches or failing to respond to data subject rights in time. Reviewing your online store against the GDPR reduces the risk of investigations and fines.
Cookies and tracking on your online store
Analytics, preference or advertising cookies (and similar technologies) involve processing of personal data. Those that are not strictly necessary for the requested service require prior consent before being placed. You must inform users in a cookie policy which cookies you use, for what purpose and duration, and provide a banner that allows accept or reject by category (not just “Accept all”). A banner that does not allow rejection or does not link to a clear cookie policy is one of the most common grounds for complaints and fines. See also our article on web legal texts and cookies.
Record of processing activities and security measures
The GDPR requires you to maintain a record of processing activities (subject to limited exceptions for undertakings with fewer than 250 employees in certain cases) including, among other things, purposes, categories of data and data subjects, recipients, retention periods and security measures. You must also implement technical and organisational measures appropriate to the risk (pseudonymisation, encryption, access control, staff training). In ecommerce, card data is often processed by the payment gateway; you are still responsible for data you process directly (customers, orders, emails) and for having data processing agreements with providers that access personal data.
Checklist: Ecommerce and GDPR
- Up-to-date, clear privacy policy accessible before collecting data.
- Legal basis defined for each processing (contract, consent, legitimate interest).
- Free and unambiguous consent; unchecked boxes by default for marketing and non-essential cookies.
- Cookie policy and banner with option to reject or accept by category.
- Procedure to handle access, rectification, erasure, restriction, portability and objection rights (deadlines and contact).
- Record of processing activities kept up to date.
- Data Protection Officer (DPO) designation if required (large-scale processing, sensitive data, etc.).
Related services
Need to make your ecommerce GDPR compliant?
At Satya Legal we help with privacy policy, records of processing, consent and cookies so your online store complies with the GDPR and you reduce the risk of fines.
Contact Satya Legal
