Data breach notification requirements for ecommerce stores

The average cost of a data breach reached $4.88 million globally in 2025 according to IBM's annual Cost of a Data Breach Report. For retail specifically, the figure was $3.48 million. These numbers include detection costs, legal fees, regulatory fines, customer notification and lost business. They do not include the reputational damage that follows a public breach disclosure.

Ecommerce stores are high-value targets. They hold payment card data, customer names and addresses, purchase history and account credentials. A breach of any of these triggers notification obligations under GDPR, UK data protection law, all 50 US state statutes and PCI DSS card brand rules. Understanding what each requires before a breach happens is the only way to respond correctly when one occurs.

What triggers a breach notification obligation

The trigger varies by jurisdiction but the common thread is unauthorized access to personal data that creates a risk of harm. Three elements typically must be present:

• Unauthorized acquisition or access. Someone accessed personal data who was not authorized to do so. This covers external attackers, malicious insiders, accidental exposure to unauthorized parties and even misdirected emails containing customer data.
• Personal data was involved. The accessed data constitutes personal information as defined by the relevant law. Definitions vary. Most US state laws focus on name combined with financial account numbers, SSN or government ID. GDPR covers any information relating to an identified or identifiable natural person.
• Harm threshold. Some laws require notification only when the breach is likely to result in harm. Others (including many US states and GDPR for authority notification) require notification any time the trigger conditions are met, regardless of actual harm. The safe assumption for ecommerce: if customer data was accessed by someone unauthorized, notification is likely required.

For ecommerce stores, the most common breach triggers are: payment card data theft via Magecart-style checkout skimming, unauthorized access to customer databases, credential stuffing attacks that compromise customer accounts, exposure of order history files and third-party vendor breaches affecting your customer data.

Recent ecommerce breach examples

These cases illustrate the range of breach scenarios ecommerce stores face and the regulatory consequences that follow:

• British Airways (2018). Magecart-style attack skimmed payment card data from 380,000 transactions over two weeks. The ICO initially fined BA 183 million pounds (later reduced to 20 million pounds). The breach exploited a compromised third-party JavaScript on the checkout page, exactly the scenario PCI DSS 4.0 Requirements 6.4.3 and 11.6.1 now address.
• Ticketmaster (2018). Third-party chat widget (Inbenta) was compromised and injected card-skimming code onto Ticketmaster's checkout pages. 40,000 UK customers affected. ICO fined Ticketmaster 1.25 million pounds for failing to assess the risk of third-party scripts on its payment pages.
• Macy's (2019). Magecart attack on macys.com injected skimming code into the checkout and wallet pages. Customer names, addresses, phone numbers, email addresses and payment card data were stolen. Macy's faced class action lawsuits and state AG investigations in multiple states simultaneously.
• Shopify (2020). Two rogue employees accessed customer data from approximately 200 merchants. Data included names, email addresses, physical addresses and order details. Shopify notified affected merchants, who then had to assess their own notification obligations under applicable laws.
• JD Sports (2023). Unauthorized access to a system containing order data for 10 million customers. Names, addresses, email addresses, phone numbers and order details were exposed. JD Sports notified the ICO within 72 hours and issued customer notifications. No payment data was compromised, but the order data alone triggered notification under GDPR and UK law.

The pattern is consistent: third-party script compromises on checkout pages and unauthorized database access are the two dominant breach vectors for ecommerce. Prevention means monitoring payment page scripts and securing database access. Response means having a notification process ready before you need it.

GDPR 72-hour notification requirement

Under GDPR Article 33, a personal data breach must be notified to the relevant supervisory authority within 72 hours of the controller becoming "aware" of it. This is not 72 hours after the breach occurred. It is 72 hours after you had a reasonable degree of certainty that a breach happened.

The 72-hour clock is aggressive. Most organizations need at least that long just to determine what happened and what data was affected. GDPR acknowledges this with a provision allowing phased notifications: submit an initial notification with what you know and supplement it as your investigation progresses.

The initial notification to the supervisory authority must include:

• The nature of the breach: approximate number of data subjects affected and categories of personal data involved.
• Contact details of your Data Protection Officer or another contact point.
• Likely consequences of the breach.
• Measures taken or proposed to address the breach and mitigate its adverse effects.

If the breach is unlikely to result in a risk to individuals, authority notification is not required. But you must document the breach internally and your reasoning for not notifying. The bar for "unlikely to result in risk" is higher than many controllers assume. When in doubt, notify.

Individual notification (Article 34). When the breach is likely to result in a highrisk to individuals' rights and freedoms, you must also notify affected data subjects directly "without undue delay." High risk means financial harm, identity theft, significant loss of control over personal data or discrimination. A breach exposing payment card data almost always meets this threshold. A breach exposing only email addresses might not.

Which supervisory authority? If you have an EU establishment, notify the supervisory authority where your establishment is located. If you are a non-EU business processing EU customer data, notify the authority in the EU member state where affected data subjects are located. For breaches affecting customers in multiple member states, notify your lead supervisory authority.

UK breach notification (post-Brexit)

The UK maintained GDPR-equivalent breach notification requirements post-Brexit under the UK GDPR and Data Protection Act 2018. The rules are nearly identical to EU GDPR:

• Timeline. 72 hours to notify the Information Commissioner's Office (ICO) after becoming aware of a breach that poses a risk to individuals.
• How to notify. The ICO has an online breach reporting tool at ico.org.uk. It guides you through the required information step by step.
• Individual notification. Required when the breach poses a high risk to affected individuals.
• Fines. The ICO can fine up to 17.5 million pounds or 4% of global turnover for serious breaches. In practice, ecommerce breach fines have ranged from tens of thousands to millions of pounds (British Airways: 20M pounds, Marriott: 18.4M pounds).

For ecommerce stores selling to both EU and UK customers, a single breach may require separate notifications to both an EU supervisory authority and the ICO. The processes are similar but the submissions are separate.

US state breach notification laws

All 50 US states, the District of Columbia, Puerto Rico and the US Virgin Islands have breach notification laws. There is no comprehensive federal breach notification law for general businesses. This means a single breach affecting customers in multiple states triggers dozens of simultaneous notification obligations with different requirements and timelines.

These sit alongside the broader US state privacy law landscape. Key variations:

• Personal information definitions. Most states define it as name plus one of: SSN, driver's license number, financial account number with security code, medical information or username/password. California, Colorado, Illinois and others have expanded definitions covering biometric data, geolocation, racial/ethnic origin and more.
• Notification deadlines. Range from 30 days to "without unreasonable delay" with no fixed deadline. See the table below for major states.
• Who to notify. All states require consumer notification. Most also require Attorney General notification above a threshold (typically 500 or 1,000 affected residents).
• Encryption safe harbor. Most states exempt breaches where the compromised data was encrypted with a key that was not also compromised. This is a strong incentive to encrypt customer data at rest.
• Substitute notification. When individual notification is too costly or addresses are insufficient, most states allow substitute notification via website posting and media notice.

State notification deadline table

Notification deadlines for the 15 most commercially significant US states for ecommerce:

For a national ecommerce store, the practical approach is to comply with the most stringent requirements across all applicable states. Florida's 30-day deadline and California's broad data definition are typically the binding constraints. If you can meet Florida's timeline and California's scope, you will satisfy most other states.

What personal data triggers notification

Ecommerce stores hold several categories of data that trigger notification under most laws:

Under GDPR, the threshold is lower than US state laws. Any personal data breach posing a risk to individuals triggers supervisory authority notification. An exposed email list is a notifiable breach under GDPR even if it would not be under most US state laws.

Tokenized card data is worth noting: even if you use a payment processor that tokenizes card numbers, the tokens may be linked to identifiable customers in your system. If tokens plus customer identifiers are exposed, this can still trigger notification depending on whether the token can be used to derive or access the original card data.

Consumer notification: what to say

Consumer notification letters have both legal requirements and practical considerations. A notification that is technically compliant but poorly written destroys customer trust faster than the breach itself.

Required content under most state laws:

• What happened. A brief, clear description of the incident and when it occurred. "On [date], we discovered that an unauthorized party accessed our customer database between [date range]."
• What information was involved. The specific types of personal information affected. Be precise: "names, email addresses and hashed passwords" not "certain personal information."
• What you are doing. Steps taken to address the breach and protect customers. "We have secured the affected system, engaged a forensic investigation firm and reported the incident to law enforcement."
• What customers can do. Specific, actionable steps: change your password, enable two-factor authentication, monitor your credit card statements, place a fraud alert with credit bureaus, enroll in the free credit monitoring we are providing.
• Who to contact. A phone number or email address for affected customers to get more information. Staff this adequately: understaffed breach response lines make the situation worse.

Practical guidance: write in plain language. Do not bury key information in legalese. Be specific about what data was affected. Do not hedge with "may have been accessed" when you know data was accessed. Customers and regulators respond poorly to vague, self-protective language. If you are offering free credit monitoring, lead with that.

Attorney General notification procedures

Many states require notification to the state Attorney General in addition to consumers. Thresholds and procedures vary:

• California. Notify the AG if more than 500 California residents are affected. Submit a sample of the consumer notification at the same time it is sent to consumers. Online submission via the CA AG website.
• New York. Notify the AG, the Department of Financial Services (if applicable) and the Division of Consumer Protection. NY's SHIELD Act requires notification without unreasonable delay. Online portal available.
• Texas. Notify the AG if 250 or more Texas residents are affected. Must be submitted within 60 days.
• Florida. Notify the AG if 500 or more Florida residents are affected, within 30 days. Online submission via the FL AG website.
• Massachusetts. Notify both the AG and the Office of Consumer Affairs and Business Regulation simultaneously with consumer notification. No minimum threshold.

Most AGs have online portals for breach notification. Some require specific forms. Building a breach notification tracker that maps affected customer counts by state to determine which AG notifications are required is essential preparation. Do this before a breach, not during one.

PCI DSS breach implications

A breach involving payment card data triggers a separate set of obligations under PCI DSS and card brand rules. These operate independently of legal notification requirements and run in parallel:

• Card brand notification. Visa, Mastercard, Amex and Discover each have their own incident reporting requirements. Your acquiring bank (payment processor) is your primary contact and coordinates notification to card brands. Notify your acquirer immediately upon discovering a payment data breach.
• PCI Forensic Investigator (PFI). Card brands typically require a PFI-certified firm to conduct a forensic investigation. Your acquirer will provide a list of approved PFIs. PFI costs typically run $20,000 to $100,000+ depending on the scope of the investigation. The investigation takes 4-8 weeks.
• Card brand fines. Depending on breach size and your compliance status at the time of breach, card brands can assess fines of $5,000 to $100,000 per month. Non-compliant merchants (no valid SAQ or ROC) face significantly higher fines. These flow through your acquiring bank.
• Card reissuance costs. Card brands charge back the cost of reissuing compromised cards. At $3 to $10 per card, a breach affecting 10,000 cards costs $30,000 to $100,000 in reissuance fees alone.
• Increased processing rates. Merchants found non-compliant at the time of breach face higher interchange rates for an extended period, sometimes permanently with that acquirer.

The total PCI-related costs of a payment card breach often exceed the legal notification costs. For ecommerce stores, preventing card data breaches through script integrity monitoring, Content Security Policy headers and hosted payment pages is far cheaper than responding to one.

Incident response planning

The 72-hour GDPR clock and 30-day Florida deadline make pre-planning essential. A breach is the worst possible time to figure out your notification process for the first time. IBM's data shows that organizations with a tested incident response plan save an average of $2.66 million per breach compared to those without one.

Your incident response plan should document:

• Detection and escalation. How a potential breach gets detected (monitoring alerts, vendor reports, customer complaints, card brand notifications) and who gets notified internally within the first hour. Name specific people, not roles.
• Initial assessment (0-4 hours). Who conducts the preliminary scope assessment to determine whether notification obligations are triggered. What systems to check. What logs to preserve.
• Legal counsel activation (0-8 hours). Contact details for outside breach counsel. Many notification decisions benefit from legal advice. Retain breach-specialized counsel in advance so there is no onboarding delay during an incident.
• Supervisory authority notification (0-72 hours). Pre-drafted GDPR notification template. Which supervisory authority is your lead authority. ICO contact details for UK. Login credentials for notification portals.
• Consumer notification (30 days). Pre-drafted notification letter templates. Review and approval process. Who drafts, who reviews, who approves, who sends. Email and postal notification logistics.
• AG notification tracker. Spreadsheet mapping states to deadlines, thresholds and portal URLs. Pre-populated with your most common customer states.
• Vendor and partner notification. Which vendors need to be notified and in what order. Payment processor, platform provider, email marketing tool, fulfillment partners.
• PCI forensic contacts. Pre-selected PFI firm. Contact details. Engagement terms agreed in advance.

Test the plan annually with a tabletop exercise. Walk through a realistic breach scenario with your response team. Identify gaps. Update the plan. The exercise is worth more than the document.

Breach costs and insurance

IBM's 2025 Cost of a Data Breach report breaks down the average retail breach cost of $3.48 million:

Cyber liability insurance covers most of these costs and has become standard for ecommerce stores above $5 million in revenue. Premiums range from $5,000 to $50,000 annually depending on revenue, data volumes, security controls and incident history.

Insurers now require evidence of basic security controls before issuing coverage: MFA on all admin systems, endpoint detection and response (EDR), employee security awareness training, a documented incident response plan and regular vulnerability scanning. If you cannot demonstrate these controls, you will either not qualify for coverage or face exclusions for the most likely breach scenarios.

Review your policy's coverage limits, exclusions and sub-limits carefully. Common gaps: some policies exclude PCI fines, some cap notification costs, and some require using the insurer's pre-approved vendors for forensics and legal counsel.

Prevention measures that reduce breach risk

Notification compliance matters, but the goal is to not have a breach in the first place. For ecommerce stores, the highest-risk vectors are:

• Payment page script injection (Magecart). Third-party JavaScript compromised to skim card data at checkout. This is the most common ecommerce-specific breach vector. PCI DSS 4.0 Requirements 6.4.3 and 11.6.1 specifically address this with Subresource Integrity and payment page monitoring requirements.
• Credential stuffing. Automated attacks using stolen username/password lists to access customer accounts. Mitigate with rate limiting, CAPTCHA, account lockout policies and offering MFA to customers.
• Exposed admin interfaces. Shopify admin, WordPress admin (/wp-admin) and Magento backend panels accessible from the public internet without additional authentication. Use IP allowlisting, VPN requirements or SSO with MFA for admin access.
• Third-party vendor breaches. Your ecommerce platform, email marketing tool, fulfillment partner or analytics provider gets breached and your customer data is affected. Conduct vendor security assessments. Require contractual breach notification obligations from vendors to you.
• Database exposure. Misconfigured databases, unpatched vulnerabilities or overly permissive access controls exposing customer records. Encrypt customer data at rest. Implement least-privilege database access. Monitor for anomalous query patterns.

Complyko's scanner checks for several of these risks: JavaScript supply chain vulnerabilities, missing security headers, third-party script inventories and payment page integrity.

Frequently asked questions

How quickly must I notify regulators of a data breach under GDPR?

GDPR Article 33 requires notification to the relevant supervisory authority within 72 hours of becoming aware of the breach. The clock starts when you have a reasonable degree of certainty, not when the breach occurred. You can submit a phased notification and supplement it as your investigation progresses.

Do all US states require data breach notification?

Yes. All 50 US states, the District of Columbia, Puerto Rico and the US Virgin Islands have breach notification laws. Deadlines range from 30 days (Florida, Colorado, Washington) to 60 days (Texas, Virginia, Connecticut) to "most expedient time possible" (California, New York).

What triggers a data breach notification for an ecommerce store?

The most common triggers are: payment card data theft via checkout page skimming, unauthorized access to customer databases, credential stuffing attacks that compromise logins, exposure of order histories with names and addresses, and third-party vendor breaches affecting your customer data.

How much does a data breach cost an ecommerce business?

IBM's 2025 report puts the retail average at $3.48 million per breach. This includes forensic investigation, legal fees, regulatory fines, notification costs, credit monitoring and lost business. PCI card reissuance adds $3-10 per compromised card on top of this.

Do I need to notify customers if only email addresses were exposed?

Under most US state laws, standalone email addresses without passwords do not trigger notification. Email addresses combined with passwords do trigger notification in every state. Under GDPR, any breach posing a risk to individuals requires supervisory authority notification, and even email-only breaches can meet this threshold.

What is a PCI Forensic Investigator and when do I need one?

A PFI is a security firm certified by the PCI Security Standards Council to investigate card data breaches. Card brands require a PFI investigation after any suspected payment data compromise. Your acquiring bank coordinates this. Costs run $20,000 to $100,000+ and investigations take 4-8 weeks.

Does cyber liability insurance cover data breach costs?

Yes. Cyber insurance typically covers forensic investigation, legal fees, notification costs, credit monitoring, regulatory fines (where insurable) and business interruption. Premiums are $5,000 to $50,000/year. Insurers require MFA, endpoint protection and an incident response plan.

What is the difference between GDPR notification to authorities vs individuals?

Article 33 requires notifying the supervisory authority within 72 hours for any breach likely to result in a risk to individuals (lower threshold). Article 34 requires notifying affected individuals when the breach poses a HIGH risk, such as financial harm or identity theft (higher threshold).

What should a breach notification letter include?

A compliant letter must include: what happened and when, what data was affected, what you are doing about it, specific steps customers can take (password changes, credit monitoring, fraud alerts), and contact information for questions. Write in plain language and be specific.

How do I prepare for a data breach before it happens?

Create a documented incident response plan covering: detection procedures, legal counsel contacts, notification templates (GDPR and consumer), a state-by-state AG notification tracker, vendor notification procedures and PFI contacts. Test the plan annually with a tabletop exercise.