GDPR Checklist
GDPR compliance for e-commerce stores
Online stores process names, addresses, and payment data, and usually run marketing trackers — a high-exposure GDPR profile.
Common risks
- • Marketing pixels (Meta, TikTok, Google Ads) firing before consent
- • Pre-ticked marketing opt-in boxes at checkout
- • Storing card data instead of using a compliant processor
- • No clear retention policy for order and customer data
Your checklist
- Gate all marketing/analytics tags behind explicit consent
- Use unticked, granular opt-ins for marketing
- Delegate card handling to a PCI-compliant processor
- Disclose all recipients of personal data in your privacy policy
- Offer order-history export and deletion on request
- Set retention windows for abandoned carts and inactive accounts
FAQs
Can I email customers about offers?
Only with consent, or under the narrow 'soft opt-in' for existing customers buying similar products — and always with an easy unsubscribe.
How long can I keep order data?
Keep it only as long as needed for the order, warranties, and legal/tax obligations, then delete or anonymise it.
See how your e-commerce store scores
Run a free GDPR + security audit in ~30 seconds.
Run a free audit