GDPR checklist for online stores

To run an online store under the GDPR, you need a lawful basis for every use of customer data, prior consent for non-essential cookies, a clear privacy notice, written contracts with every processor, a way to answer customer requests within one month, defined retention periods, a plan to report serious breaches within 72 hours, and a legal mechanism for any data sent outside the EU. Each item follows, with the articles behind it.

This article is general information, not legal advice. Rules also vary by member state, so check specific questions with a qualified adviser or your data protection authority.

1. Map what you collect and why

List each place personal data enters the store (checkout, account sign-up, newsletter form, contact form, live chat, reviews, analytics and ad tags) and, for each, what you collect, why, who receives it and how long you keep it. Article 5 of the GDPR requires data to be collected for specified purposes, limited to what is necessary (data minimization) and kept no longer than needed.

Article 30 asks for a written record of processing activities. Organizations with fewer than 250 employees are exempt only if the processing is occasional, unlikely to create a risk and excludes special categories of data. Because an online store processes customer data continuously, most stores should assume the exemption does not apply and keep the record.

2. Pick a lawful basis for each purpose

Article 6(1) lists six lawful bases. Three do almost all the work in e-commerce:

Processing	Usual lawful basis	Notes
Taking and delivering orders, payments, returns	Contract, Art. 6(1)(b)	Only the data the order actually needs.
Invoices and tax records	Legal obligation, Art. 6(1)(c)	Retention period set by tax law.
Fraud prevention	Legitimate interests, Art. 6(1)(f)	Recital 47 names fraud prevention as a legitimate interest; document your balancing test.
Marketing email to new subscribers	Consent, Art. 6(1)(a)	Required by Art. 13(1) of the ePrivacy Directive.
Marketing email to existing customers about similar products	Legitimate interests, with the ePrivacy "soft opt-in"	Opt-out offered at collection and in every message.
Analytics and ad cookies or pixels	Consent	Required by Art. 5(3) of the ePrivacy Directive.

Two traps are common. First, consent is not a safer default: if you rely on it, Article 7(3) says it must be "as easy to withdraw as to give consent", and Article 17 then generally requires erasure where no other legal ground exists. Second, the soft opt-in in Article 13(2) of the ePrivacy Directive only covers your own similar products, sold to people who became customers, and only if they could object free of charge when you collected the address and in every message. Anyone else needs prior consent.

3. Get cookie consent right

Article 5(3) of the ePrivacy Directive, as amended in 2009, allows storing or reading information on a visitor's device only with consent, unless it is strictly necessary for a service the user explicitly requested (for example, the cart or login session). In October 2024 the EDPB adopted final Guidelines 2/2023, which read the technical scope broadly, so tracking pixels and similar techniques are in scope too, not just cookies.

The EDPB's Cookie Banner Taskforce report (January 2023) and consent guidelines 05/2020 set out practical tests. Use them as your banner checklist:

Reject on the first layer. Most authorities considered a banner with an accept button but no reject option on any layer to be an infringement.
No pre-ticked boxes. Pre-ticked categories do not produce valid consent.
No nudging by design. Button colors and contrast must not be obviously misleading; this is assessed case by case.
No scrolling as consent. Scrolling or swiping is not a clear affirmative action.
No cookie walls. Blocking content until the visitor clicks "Accept" means consent is not freely given.
Easy withdrawal. Offer a permanently visible icon or link that reopens the settings.
Nothing fires before consent. Test in a clean browser that analytics and ad tags wait for opt-in, and record consent so you can prove it later.

If you send conversions to ad platforms from your server, the consent choice still has to travel with them. Our guide to first-party analytics covers what server-side tracking does and does not change, and Consent Mode explains how the consent state is passed to Google.

4. Publish a complete privacy notice

Article 13 lists what you must tell people when you collect their data, in concise, plain language (Article 12). Check your notice includes:

Your identity and contact details, and your data protection officer's details if you have one.
Each purpose and its lawful basis, and the legitimate interests you rely on.
Recipients or categories of recipients (payment provider, carrier, email platform, hosting).
Any transfer outside the EU and the safeguard used.
Retention periods, or the criteria that set them.
The rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw consent, and the right to complain to a supervisory authority.
Whether data is required by contract or law, and any automated decision-making.

For direct marketing, Article 21(4) requires the right to object to be brought explicitly to the customer's attention, separately from other information, at the latest at the first communication.

5. Sign a DPA with every processor

Your hosting provider, email service, payment provider (for the parts it handles on your behalf), help desk and analytics tools usually act as processors. Article 28 says you may only use processors that give sufficient guarantees, and the relationship must be governed by a contract (a data processing agreement, or DPA) that covers, among other things:

Processing only on your documented instructions, including on transfers.
Confidentiality of staff and appropriate security measures.
Rules for sub-processors, with notice so you can object to changes.
Help with customer requests and breach handling.
Deletion or return of the data when the service ends.

Keep a list of processors and their DPAs; it feeds your privacy notice and processing record.

6. Handle data subject requests on time

Customers can ask for access (Article 15), correction, erasure (Article 17), restriction, portability in a machine-readable format (Article 20) and can object (Article 21). Article 12(3) sets the deadline: without undue delay and within one month of receipt, extendable by two further months for complex or numerous requests if you tell the customer within the first month.

A practical setup: one published contact address, a way to verify identity that does not collect more data than needed, a log of each request and its deadline, and a tested export of a customer's account, orders and marketing history. Erasure is not absolute; invoices you must keep for tax law stay, but marketing profiles and unneeded account data go.

7. Set retention periods and enforce them

The storage limitation principle in Article 5(1)(e) means each data set needs an end date. Typical decisions for a store: order and invoice records for the period your national tax law requires; abandoned accounts deleted after a defined period of inactivity; newsletter data kept until unsubscribe plus a short suppression record; support tickets and form submissions deleted after a set number of months. Publish the periods and automate deletion.

8. Prepare for a personal data breach

Under Article 33, the controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to people. Late notifications must explain the delay. A processor must tell you without undue delay. Where the risk to people is high, Article 34 requires informing the affected customers directly.

The EDPB's Guidelines 9/2022 (version 2.0, adopted April 2023) add practical detail. Before anything happens, decide who assesses a breach, who contacts the authority, and where you record every breach, including those you do not report. Account security matters here too; our post on security as a feature covers the platform questions to ask.

9. Check international transfers

Chapter V (Articles 44 to 49) applies whenever data leaves the EU/EEA, including to a US email or analytics tool. Transfers are straightforward to a country with an adequacy decision; the European Commission lists them, including the United Kingdom, Switzerland, Japan and US companies certified under the EU-US Data Privacy Framework. Otherwise you need an Article 46 safeguard, most often the standard contractual clauses the Commission modernized on 4 June 2021. For each tool, record where data goes and which mechanism covers it. Where your platform hosts data matters as well; we explain our reasoning in why we built CIQRA in the EU.

Where CIQRA fits

No platform can make a store GDPR-compliant on its own; your lawful bases, notice, contracts and processes remain your responsibility. What CIQRA provides is groundwork: data hosted in Microsoft Azure data centers in Germany, with AI text processing in the EU data zone; each store's data kept apart at database level; cookie consent in 40 languages, with no tracking cookies until visitors opt in, an automatic cookie inventory, recorded consent, Consent Mode v2 and GPC support; and forms where suspicious entries are quarantined for 30 days.

FAQ

Does the GDPR apply to a store outside the EU?

It can. Article 3(2) covers businesses outside the EU that offer goods or services to people in the EU, so a store shipping to EU customers should plan as if it applies.

Is analytics exempt from cookie consent?

Not under the text of Article 5(3), which only exempts storage strictly necessary for the service the user requested. National rules and regulator guidance on audience measurement differ, so check what your own data protection authority says before treating any analytics as exempt.

GDPR checklist for online stores: a practical 2026 guide