A shop processes data by nature, not by accident
On a brochure website, the collection of personal data is often limited to a contact form. On an online shop, it is intrinsic to how the business works: you cannot sell without a name, a delivery address, contact details, an order history and payment data.
This difference changes the nature of the subject. Compliance is no longer a formality added afterwards but a design constraint that affects the checkout journey, the database, analytics tools and the service providers connected to the shop. Dealt with at the end of a project, it almost always means going back on choices already made.
The framework discussed here is the one that applies to any business selling to customers in the European Union: the General Data Protection Regulation (GDPR) and, for cookies and marketing emails, the ePrivacy rules as transposed into each member state's law. The examples of guidance quoted come from France's data protection authority, the CNIL, whose positions are in line with those of its European counterparts. Countries outside the EU, such as the United Kingdom or Switzerland, have their own equivalent laws, close in spirit but not identical.
Know what you collect, before anything else
The starting point is not legal but factual: drawing up the actual list of data passing through the shop. The exercise often comes as a surprise, because a modern online shop collects far more than the merchant has consciously decided to.
There is the obvious data, entered by the customer: identity, billing and delivery addresses, phone number, email address, order contents. There is data generated automatically: IP address, browsing history, abandoned baskets, session identifiers. And there is data produced by the third-party tools grafted onto the shop: analytics, advertising pixels, support tools, email marketing platforms, customer review modules, delivery services.
Each of these flows has its own purpose and legal basis. Processing an order falls under performance of the contract. Sending a newsletter falls under consent. Analysing purchasing behaviour for advertising purposes also falls under consent. Confusing these regimes is the most common mistake, and the most visible one during an inspection.
The cookie banner, the most inspected area
This is the most visible part of a shop, and the one where most breaches are found. The applicable rules have been stable for several years and leave little room for interpretation.
Trackers that are strictly necessary for the site to work, such as the basket or the session, do not require consent. All the others (non-exempt analytics, advertising, personalisation, social media) may only be set after the user has actively agreed. In practice, this means that no tracking script should fire when the page loads, before the user has made any choice.
Three requirements are regularly found wanting on online shops. Refusing must be as easy as accepting, which rules out banners where only the accept button is visible. A refusal must be respected without degrading access to the site. And users must be able to change their choice at any time, which requires a permanent entry point to their preferences, not just a banner shown once.
Marketing emails follow their own rules
Email marketing is the other risk area, partly because it rests on a widespread misconception: having a customer's address does not automatically allow you to send them offers.
The general principle is prior consent. There is, however, an important exception in retail, provided for by the European ePrivacy rules: a customer who has already bought from you may receive messages about similar products or services, provided they were informed when their details were collected and can easily object with each message. This exception does not cover people who have never bought anything, nor offers unrelated to the original purchase.
In practice, this imposes two things at the design stage: a newsletter sign-up box separate from order confirmation, never pre-ticked, and a genuinely working unsubscribe link in every message. A list built by mixing customers with people who have never bought, with no record of consent, becomes very difficult to clean up after the fact.
The providers that process your data commit you
A shop relies on external services: hosting provider, payment platform, carrier, email marketing tool, support solution. Each has access to all or part of the customer data, and the merchant remains responsible for what they do with it.
This means knowing exactly who has access to what, having a contract governing that processing with each provider (a data processing agreement), and checking where the data is hosted. A transfer outside the European Union is not prohibited, but it requires specific safeguards that are better identified before choosing the tool than after integrating it into the shop.
This is also a practical argument for restraint: every module added to a shop widens the compliance surface to maintain. A list of twenty extensions, half of which are no longer used, is as much a compliance problem as a performance problem.
How long to keep data
The question comes up every time, and the answer is not "as long as possible". Each category of data has a retention period justified by its purpose, beyond which it must be deleted or archived.
Order data is subject to accounting obligations and is kept for several years on that basis, the exact period depending on national law, but that does not mean it must remain accessible in the live database. Marketing data is kept for as long as the relationship exists, then purged. Customer accounts that have been inactive for a long time are not meant to be kept indefinitely.
Defining these periods and actually applying them is one of the least addressed points on online shops, because nothing makes it visible day to day. Yet it is one of the first things requested during an inspection.
Security is part of compliance
The subject is often reduced to documents and banners, forgetting that data protection also requires technical measures proportionate to the risk. A shop that displays an impeccable privacy policy but whose back office can be accessed with a weak password is not compliant.
The expected baseline remains within reach: encryption of traffic across the whole site, not just the payment page; named administrator accounts rather than a shared login; stronger authentication on sensitive access; updates applied regularly; and tested backups. Storing card data, for its part, does not have to be the merchant's burden: it is the payment provider's job, and trying to keep it yourself adds considerable risk for no benefit.
You also need to plan for a data breach. If an incident exposes customer data, the business must be able to react quickly, document what happened and, depending on severity, notify the supervisory authority (within 72 hours under the GDPR) and then the people affected. Knowing in advance who does what in this situation avoids discovering the procedure at the worst possible moment.
Customers' rights must be usable
A customer can ask to access their data, have it corrected or deleted, or object to certain processing. The business must be able to respond within a set deadline, in principle one month.
This does not require a complex system, but it does require having thought about it before the first request: knowing where the data is stored, being able to extract it, knowing what can be deleted and what must be kept for legal reasons. A dedicated contact address and a written internal procedure are generally enough for a small or medium-sized business.
A project to tackle in stages
An online shop's compliance is not settled by installing a plugin. It is built through an inventory of data and tools, a review of the consent banner, clarification of the legal basis for each processing activity, putting provider contracts in order, and defining retention periods.
None of these steps is beyond the reach of a small or medium-sized business, but carrying them out in sequence takes method. Our e-commerce audit covers this area alongside customer journeys and performance, and our e-commerce maintenance and support service keeps that compliance up to date over time rather than starting again every two years. The question of consent is covered in detail in our article on cookies and audience measurement. We help you implement these measures on your site; we do not provide legal advice.
Sources (France's CNIL, in French): CNIL, websites, cookies and other trackers · CNIL, marketing by email