GDPR Checklist for Online Shops: Fix This Before Fines Hit

A GDPR checklist for online shops covers eight areas: cookie consent, the data you collect at checkout, marketing emails, your privacy policy and records, the companies that process data for you, customer requests, how long you keep data, and what you do when something leaks. Each item below is a yes-or-no check you can run on a live shop, with the article of the law or the regulator guidance it comes from.

The checklist is for the owner of a shop that already exists and asks whether it is run lawfully day to day. If you are planning a new shop or a rebuild, the technical side (architecture, consent implementation, deletion jobs, choice of hosting and integrations) is covered in how to build GDPR into a webshop. We are a web studio, not a law firm, so treat this as practical guidance rather than legal advice. For a breach, a regulator inquiry, or sensitive data such as health information, talk to a lawyer or a data protection officer.

In short

Trackers that are not strictly necessary must not run before the visitor consents (ePrivacy Directive, Article 5(3)). Pre-ticked boxes are not consent (CJEU, Planet49).
You must answer access and deletion requests within one month, extendable by two further months for complex cases (GDPR Article 12(3)).
A notifiable breach goes to your data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of it (GDPR Article 33(1)).
Every service that handles customer data on your behalf needs an Article 28 processor agreement.
Invoices stay for the period your national tax law sets. Marketing data and inactive accounts do not get that protection.

The rule comes from Article 5(3) of the ePrivacy Directive: storing or reading information on the visitor’s device needs consent unless it is strictly necessary for a service the visitor asked for. Each country writes this into national law. In Germany it is § 25 TDDDG, in Ireland Regulation 5 of S.I. 336/2011.

Nothing non-essential loads before consent. Analytics, ad pixels, heatmaps and most chat widgets are not strictly necessary. Test it: open the shop in a private window, decline the banner and watch the browser’s network tab. If requests to an ad or analytics domain fire anyway, the banner is not working. The EDPB’s guidelines on the technical scope of Article 5(3) (version 2.0, adopted 7 October 2024) confirm that the rule also covers tracking pixels and tracking links.
Reject is on the same layer as accept. In the EDPB’s cookie banner taskforce report (January 2023), a vast majority of authorities considered a banner without a reject option on the layer that has the accept button an infringement. A reject “link” hidden in body text, or a reject button with unreadable contrast, was also flagged. Ireland’s DPC guidance note on cookies (April 2020) says that an accept button must be matched by a reject or manage option of equal prominence.
No pre-ticked boxes, on any layer. The CJEU held in Planet49 (C-673/17, 1 October 2019) that a pre-checked box the user must untick is not valid consent, and that the rule applies whether or not the cookie holds personal data.
Only cookies that are truly necessary are labelled exempt. The Irish DPC’s examples of exempt cookies include a session cookie that holds the shopping basket and a load-balancing cookie. Analytics cookies, the same guidance says, require consent. The EDPB taskforce named mislabelled “essential” cookies as a practice it found, and it said legitimate interest cannot be the legal basis for placing cookies. One national exception: France’s CNIL exempts audience measurement from consent under strict conditions, such as truncated IP addresses and a 13-month cookie lifetime, and says most large analytics offerings don’t qualify. Don’t assume the French exemption applies in other countries.
You can prove consent and the visitor can withdraw it. GDPR Article 7 requires you to be able to demonstrate consent and says it must be as easy to withdraw as to give. A permanent “cookie settings” link in the footer is the usual way. The Irish DPC suggests asking for consent again no later than six months after you stored the choice.
You still need every tracker you run. Each one you remove is one less consent problem. Cookieless, EU-hosted measurement is covered in GDPR-compliant analytics.

Checkout and account data

The checkout asks only for what the order needs. The data minimisation principle (GDPR Article 5(1)(c)) applies to every form field. The EDPB’s guidelines on data protection by design use an online bookshop as the example: date of birth and phone number cannot be required fields for a prepaid order, and an e-book order needs no postal address. The CJEU reached a similar result in Mousse (C-394/23, 9 January 2025): asking online ticket buyers for a title (Mr or Ms) was not necessary to perform the contract.
Customers can buy as a guest. In its draft Recommendations 2/2025 on the legal basis for requiring the creation of user accounts on e-commerce websites (version 1.0, adopted for public consultation on 3 December 2025; no final version had been published as of October 2026), the EDPB says forcing account creation is justified only in a few cases, such as subscriptions, and calls a guest mode “in principle” the most privacy-protective way to buy.
The newsletter box is unticked and separate from the terms. Under GDPR Article 7(2), a consent request must be clearly distinguishable from other matters, so it can’t sit inside “I accept the terms of sale”. Article 7(4) also counts it against consent being freely given if the sale depends on agreeing to processing the sale doesn’t need.
Saved cards are opt-in. If you keep card details to speed up the next purchase, the EDPB’s Recommendations 02/2021 say consent is the only appropriate legal basis.
Card numbers never reach your server. Use your payment provider’s hosted checkout or embedded fields. Stripe’s integration security guide says its low-risk integrations send payment details directly to Stripe “without it passing through your servers”, which reduces your PCI DSS obligations.

Marketing emails and abandoned carts

Newsletter sign-ups are consented and logged. Store when, where and how each person signed up. Double opt-in is not written into the GDPR, but it is the simplest proof under Article 7(1).
The existing-customer exception is used as written. ePrivacy Article 13(2) lets you email your own customers about your own similar products without new consent, but only if you got the address “in the context of the sale”, offered an opt-out when you collected it, and offer one in every email. National rules on this vary.
Abandoned-cart emails have a basis. Someone who left a cart has not bought anything, so it’s unclear whether the existing-customer exception covers them. The safe setup is to send cart reminders only to people who opted in to marketing or asked for the cart to be emailed.
Unsubscribing works at once, everywhere. When someone objects to direct marketing, their data may no longer be used for it (GDPR Article 21(3)). That includes customer lists synced to ad platforms.

If you are budgeting for email as a channel, see email marketing costs.

Privacy policy and records

The privacy policy describes your actual setup. GDPR Article 13 lists what you must tell people when you collect their data: purposes, legal bases, recipients, transfers outside the EU, retention periods and their rights. A template that names tools you don’t use, or misses ones you do, fails this.
The cookie information says how long each cookie lasts and who can read it. Planet49 held that this is part of the information Article 5(3) requires.
You keep a record of processing activities. Article 30(5) exempts organisations with fewer than 250 employees only if the processing is occasional, unlikely to be risky and doesn’t include special categories of data or criminal-offence data. A shop processes customer data with every order, which is not occasional, so plan on keeping the record. A table is enough: what data, why, legal basis, where it is stored, which processors, how long it is kept.

Processors and transfers outside the EU

Every processor has a signed Article 28 agreement. Hosting, the shop platform, email, payments, fulfilment, support desk and analytics all count. Article 28(1) also requires you to use only processors that provide “sufficient guarantees”, so the agreement alone isn’t the whole check.
US transfers rest on something current. The EU-US Data Privacy Framework (Commission decision of 10 July 2023) covers only US companies certified under it. The General Court dismissed a challenge to it on 3 September 2025, and an appeal (C-703/25 P) was lodged with the Court of Justice on 31 October 2025. It was still pending in October 2026, with no Advocate General’s opinion or judgment yet. The framework before it, the Privacy Shield, was struck down by the Court of Justice in 2020 (the decision recalls this in recital 5), so treat US transfers as a dependency to review. We explain the background in EU hosting vs US cloud.

Customer requests

You can answer within one month. Article 12(3) sets one month from receipt, extendable by two further months “where necessary, taking into account the complexity and number of the requests”. If you extend, you must say so within the first month. Know in advance which systems you would search: the shop database, email tool, support desk and ad audiences.
You can export what the customer gave you. Data portability (Article 20) applies to data processed on the basis of consent or contract, in a “structured, commonly used and machine-readable format”.
You can delete, except what the law makes you keep. Erasure does not apply where processing is needed to comply with a legal obligation (Article 17(3)(b)), so invoices stay and the customer is told why.

How long you keep data

Each data type has a retention period. Personal data may be kept only as long as the purpose requires (Article 5(1)(e)). Invoices are the exception that the law sets for you: the VAT Directive (Article 247) leaves the storage period to each member state, so check your national tax authority’s rule.
Deletion actually happens. Inactive accounts, abandoned carts and lapsed marketing profiles have no tax-law reason to stay. A retention period that only exists in the privacy policy doesn’t count. Ask whoever runs the shop to show you the scheduled job.

Security and data breaches

The basics are in place. Article 32 requires security “appropriate to the risk”, including encryption where appropriate, the ability to restore data after an incident, and regular testing. In practice: HTTPS everywhere, an updated platform and plugins, two-factor login for admins, and backups you have restored at least once.
You know the 72-hour rule and who acts on it. A breach goes to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people (Article 33(1)). If the risk to customers is high, you must also tell them without undue delay (Article 34). Your processors must tell you without undue delay (Article 33(2)).
You log every breach, even the ones you don’t report. Article 33(5) requires you to document all personal data breaches, their effects and what you did.

Do you need a DPO or an EU representative?

You know whether you need a data protection officer. One is required when your core activities involve “regular and systematic monitoring of data subjects on a large scale” (Article 37(1)(b)). Most small shops don’t reach that level, but heavy behavioural tracking can.
A shop based outside the EU has an EU representative. If it sells to people in the EU, it generally needs one under Article 27, unless its processing is occasional, low-risk and doesn’t include large-scale processing of sensitive data (Article 27(2)(a)).

What non-compliance can cost

Article 83(5) caps fines for breaches of the core principles, consent conditions and data subject rights at €20 million or 4% of worldwide annual turnover, whichever is higher. Authorities set the actual amount case by case, and Article 83(2) tells them to weigh factors such as the nature, gravity and duration of the infringement. A data subject can also claim compensation in court under Article 82.

Getting the checklist implemented

Most items on this list are decided by how the shop is built: which scripts load when, which fields are required, whether deletion is automated. Our GDPR-compliant webshop development covers those flows from payment to analytics. E-commerce builds fall under our Build tier at €7,900+ excl. VAT, as a fixed quote agreed in writing before work starts. Ongoing maintenance is available on monthly plans, and all prices are on our pricing page.

If you are still choosing a platform, the compliance work differs between hosted and custom shops. See Shopify vs custom webshop. If you want us to look at a shop you already run, get in touch.

Cookies and consent