What do you need to do for GDPR in an online store?

Q&A • GDPR

What do you need to do for GDPR in an online store?

An online store processes personal data on every order: name, address, phone, purchase history. GDPR does not require consent for all of it — it requires a correct legal basis for each purpose and transparency towards the customer.

Short answer

  1. Fulfilling the order relies on the contract as legal basis, not on consent.
  2. Consent remains mandatory for newsletters and for marketing cookies.
  3. You keep a record of processing activities, as required by GDPR Article 30.
  4. You publish a privacy policy and a cookie policy, written for your own store's situation.
  5. You answer access, rectification and erasure requests within one month.

What the law says (in brief)

  • Regulation (EU) 2016/679 (GDPR) applies directly, supplemented in Romania by Law 190/2018.
  • Article 6 requires a legal basis: contract, legal obligation, legitimate interest or consent.
  • Article 30 requires a record of processing activities, including for small firms with regular processing.
  • Cookies that are not strictly necessary require prior consent, not just an informational banner.
  • Invoices are retained under accounting law even if the customer asks for account deletion.

Practical example

Example: a customer buys once and later asks for account deletion. The store deletes the account, the saved delivery address and the newsletter subscription, but keeps the invoice and its tax data, because it has a legal archiving obligation. The reply to the request is sent in writing within one month.

Common mistakes

  • Asking for consent for everything, including order fulfilment — the correct basis is the contract.
  • Pre-ticking the newsletter box at checkout; consent must be an active action.
  • Loading analytics and remarketing scripts before the visitor accepts cookies.
  • Copying a generic privacy policy without listing your actual processors (courier, payment provider).

How 4shopy helps

  • A cookie banner that actually blocks scripts until acceptance, not just an informational notice.
  • Newsletter subscription is explicit opt-in, with proof of the moment of consent.
  • Export and delete a customer's data from a single screen, for GDPR requests.
  • Privacy and cookie policy templates, adaptable to your actual providers.

See also