GDPR compliance checklist for ecommerce stores (2026)

GDPR has been in force since May 2018. Fines in 2025 exceeded 2 billion euros. Yet most mid-market ecommerce stores still have significant gaps, not from wilful non-compliance, but from incomplete implementation and configuration drift as platforms, apps and marketing stacks evolve.

This checklist covers every core GDPR obligation relevant to an ecommerce operation. Work through it section by section. Each item is actionable and maps to a specific GDPR article or regulatory guidance.

1. Applicability: does GDPR apply to your store?

Many US-based stores assume GDPR does not apply to them. That assumption is wrong for most mid-market operations.

GDPR Article 3 sets out the territorial scope. It applies if your store meets either of these conditions:

• You offer goods or services to individuals in the EU, even for free. Shipping to EU addresses, displaying prices in euros or accepting EU payment methods all indicate you are targeting EU consumers.
• You monitor the behaviour of individuals in the EU. Running remarketing pixels, analytics or personalisation on visitors from EU countries constitutes monitoring under GDPR.

If your store ships internationally or runs any form of digital advertising, GDPR almost certainly applies. The correct question is not whether GDPR applies but how much of it applies given your data processing activities.

Checklist items for applicability:

• Determine whether you have EU customers or EU web traffic. Check your analytics by country.
• If EU traffic or orders exist, treat GDPR as fully applicable.
• Identify which EU member states your customers are primarily located in. This determines which lead supervisory authority oversees your compliance.
• If you have an EU establishment (office, subsidiary, registered branch), you are subject to GDPR as a data controller established in the EU regardless of traffic volume.

2. Lawful basis for processing

Every processing activity must have a lawful basis under GDPR Article 6. For ecommerce, three bases are most relevant: contractual necessity, legitimate interest and consent.

Contractual necessity (Article 6(1)(b)): Processing required to fulfil an order or perform a contract the customer has entered into. This covers order processing, shipping, delivery notifications and customer account management. You do not need consent for these activities. You cannot use consent for them either, because refusing consent would prevent contract performance.

Legitimate interest (Article 6(1)(f)):Processing where your legitimate business interest outweighs the data subject's rights, after a documented balancing test. Fraud prevention, security logging and some forms of direct marketing to existing customers can rely on legitimate interest. You must document the legitimate interest assessment (LIA). If challenged, you need to show you conducted it.

Consent (Article 7): An affirmative, freely given, specific, informed and unambiguous indication of agreement. Required for non-essential cookies, most marketing communications to prospects and any processing that cannot be justified under another basis. Consent must be as easy to withdraw as to give.

Checklist items for lawful basis:

• Map all data processing activities to a lawful basis. Document this in your Records of Processing Activities (RoPA).
• Confirm order processing relies on contractual necessity, not consent.
• Conduct and document a legitimate interest assessment for any processing that relies on Article 6(1)(f).
• Ensure marketing consent is collected separately from terms of service acceptance and is not bundled with order placement.
• Record consent with timestamp, mechanism and version of the consent notice shown.

3. Cookie consent

Cookie consent is the most common GDPR enforcement trigger for ecommerce stores. The rules are set by GDPR in combination with the ePrivacy Directive. Getting this wrong is immediately detectable by automated scanning.

The five most common cookie consent mistakes are pre-checked consent boxes, no way to reject without friction, firing scripts before consent, misclassifying cookies as strictly necessary and providing no withdrawal mechanism.

Checklist items for cookie consent:

• Audit every cookie set by your store. Use browser developer tools. Document the name, purpose, provider and duration of each cookie.
• Classify cookies correctly: strictly necessary (session, cart, CSRF), analytics, marketing, personalisation. Only strictly necessary cookies may load without consent.
• Configure your consent management platform (CMP) so all non-essential categories default to off.
• Provide a "Reject all" or "Necessary only" button that is equally prominent as "Accept all." Same visual weight, same number of clicks.
• Block non-essential scripts from loading until consent is given. This requires CMP callbacks or tag manager consent mode configuration. Google Consent Mode v2 is the minimum requirement for Google tags.
• Provide a persistent cookie settings link in your footer that reopens the consent panel.
• Store consent records: timestamp, user identifier, consent version, categories accepted.
• Review cookie audit quarterly. New apps and theme updates regularly add new cookies.

4. Privacy policy

GDPR Articles 13 and 14 require you to provide specific information to data subjects at the point of collection. For ecommerce, this means a comprehensive privacy policy that covers every processing activity.

Checklist items for privacy policy:

• Identity and contact details of the data controller (your business name, address, email).
• Contact details of the data protection officer, if you have one.
• Purpose and lawful basis for each category of processing: order fulfilment, marketing, analytics, fraud prevention, legal obligations.
• Categories of personal data collected: name, address, email, payment data, browsing behaviour, device identifiers.
• Recipients or categories of recipients: payment processors, shipping carriers, marketing platforms, analytics providers, cloud infrastructure.
• International transfers: if any data is transferred outside the EU or UK, name the countries and safeguards (Standard Contractual Clauses, adequacy decision).
• Retention periods for each data category. "We keep data as long as necessary" is not sufficient. Specific periods are required.
• Data subject rights: access, rectification, erasure, restriction, portability, objection, withdrawal of consent, right to lodge a complaint with a supervisory authority.
• Whether providing data is a statutory or contractual requirement and the consequences of not providing it.
• Any automated decision-making or profiling, including logic involved and significance of the outcome.
• Keep the policy current. Update it whenever you add new processors, change retention periods or introduce new processing activities.

5. Data subject access requests

GDPR Article 15 gives individuals the right to obtain confirmation of whether you process their data and a copy of that data. For ecommerce, this means being able to retrieve all data held on a customer across your order management system, email platform, analytics tools and any other system that holds personal data.

A detailed operational guide to handling DSARs for ecommerce covers the full process, including verification, scope and what to include in your response.

Checklist items for DSARs:

• Create a clear DSAR submission channel: a dedicated email address, an in-account request form or a contact form that routes DSAR requests to the right team.
• Document your one-month response clock. The deadline runs from receipt of the request, not from identity verification.
• Build an internal process to retrieve data from every system that holds personal data: ecommerce platform, ESP, CRM, analytics, support system, loyalty programme.
• Train customer service on DSAR recognition. Requests do not need to use the phrase "data subject access request" to trigger GDPR obligations.
• Log all DSARs with date received, identity verified date, response sent date and outcome.
• Do not charge a fee for routine requests. Fees are only permitted for manifestly unfounded or excessive requests.
• Have a process for the right to erasure (Article 17) and right to portability (Article 20) as well. These often arrive alongside access requests.

6. Data retention policies

GDPR Article 5(1)(e) requires that personal data is kept no longer than necessary for the purposes for which it was collected. Many ecommerce stores have no defined retention periods, keeping customer data indefinitely.

Building a proper data retention policy for ecommerce requires mapping each data category to a business or legal justification for the retention period.

Checklist items for data retention:

• Define retention periods for each data category: order records (typically 7 years for VAT and accounting compliance), customer accounts (active + 2-3 years dormant), marketing consent records (duration of relationship plus evidence of consent withdrawal), browsing and analytics data (typically 13-26 months), support tickets, fraud logs.
• Implement automated deletion or anonymisation at the end of each retention period. Manual deletion does not scale.
• Distinguish between legal retention obligations (tax records, VAT invoices) and operational retention preferences. Legal obligations override erasure requests. Operational preferences do not.
• Apply retention periods to backups as well as live systems. Data in backups is still personal data under GDPR.
• Review retention periods annually. Business needs and legal requirements change.

7. Cross-border data transfers

GDPR Chapter V restricts transfers of personal data to countries outside the European Economic Area (EEA) unless adequate protections are in place. For most ecommerce stores, cross-border transfers happen through third-party tools: US-based email platforms, analytics providers, cloud infrastructure, CDNs and payment processors.

A complete guide to cross-border data transfers for ecommerce covers the available transfer mechanisms and how to implement them.

Checklist items for cross-border transfers:

• Map all data flows to identify transfers outside the EEA. Any SaaS tool with US-based servers that processes EU personal data is a cross-border transfer.
• Identify the legal mechanism for each transfer: adequacy decision (UK, Japan, South Korea, Switzerland among others), Standard Contractual Clauses (SCCs, most common for US tools), Binding Corporate Rules (for intra-group transfers in multinationals), or derogations (narrow exceptions for specific situations).
• Execute SCCs with every processor that transfers data outside the EEA. Most major SaaS providers provide these in their data processing agreements (DPAs). Locate and countersign them.
• Conduct a Transfer Impact Assessment (TIA) where SCCs are the mechanism and the recipient country has laws that could undermine the protection. This is required post-Schrems II.
• Document all transfers and their legal bases in your RoPA.
• Monitor the adequacy status of recipient countries. Adequacy decisions can be revoked (as happened with the original Privacy Shield).

8. Data protection officer

GDPR Article 37 requires certain organisations to appoint a Data Protection Officer. For most mid-market ecommerce stores, appointment is not mandatory, but it is good practice.

Checklist items for DPO requirements:

• Assess whether a DPO is mandatory for your organisation. The obligation applies to: public authorities, organisations that carry out large-scale systematic monitoring of individuals, organisations that carry out large-scale processing of special category data. Most ecommerce stores do not fall into these categories unless they operate at significant scale with profiling or health-related data.
• Even if not mandatory, consider appointing a DPO or designating a privacy lead internally. Someone must own GDPR compliance.
• If you appoint a DPO, publish their contact details on your privacy policy and register them with your lead supervisory authority.
• The DPO must be independent and cannot be dismissed for performing their role. They should report directly to senior management.

9. Data protection impact assessments

GDPR Article 35 requires a Data Protection Impact Assessment (DPIA) before processing that is likely to result in high risk to individuals. For ecommerce, this typically means profiling, large-scale processing of sensitive data or systematic monitoring.

Checklist items for DPIAs:

• Identify processing activities that require a DPIA: behavioural profiling for personalisation or pricing, large-scale processing of location data, credit scoring or fraud detection models that make automated decisions with significant effects.
• Conduct a DPIA before launching new high-risk processing. Document the nature, scope, context and purposes of the processing, the necessity and proportionality assessment, identified risks and the measures to address them.
• If the DPIA identifies a high residual risk that cannot be mitigated, consult your supervisory authority before proceeding (prior consultation, Article 36).
• Review existing DPIAs when processing activities change materially.

10. Breach notification

GDPR Article 33 requires notification to your supervisory authority within 72 hours of becoming aware of a personal data breach. Article 34 requires notification to affected individuals where the breach is likely to result in high risk to their rights and freedoms.

Your obligation and the specific steps required are covered in detail in the guide on data breach notification for ecommerce.

Checklist items for breach notification:

• Define what constitutes a personal data breach internally. It includes accidental loss, destruction, alteration, unauthorised disclosure or access, not just malicious attacks.
• Establish an incident response process. Who decides if a breach is notifiable? Who drafts the regulator notification? Who communicates with customers?
• Document every incident, even those that do not meet the threshold for notification. GDPR requires a breach register regardless of whether a notification is made.
• Know which supervisory authority to notify. If you are established in the EU, notify your lead supervisory authority. If you are based outside the EU with no EU establishment, notify the authority in each member state where affected individuals are located.
• Prepare a notification template in advance. The 72-hour window is tight. You should not be drafting from scratch during an incident.
• Test your incident response process. Run a tabletop exercise annually.

11. Processor agreements

GDPR Article 28 requires a written contract between a data controller and any data processor. Every third-party tool that processes personal data on your behalf is a processor: your ESP, payment gateway, CRM, analytics platform, fulfillment partner, cloud hosting provider.

Checklist items for processor agreements:

• Identify all processors. Any tool that accesses or processes personal data belonging to your customers is a processor, even if you think of it as just a software subscription.
• Execute a Data Processing Agreement (DPA) with each processor. Most major providers offer standard DPAs in their compliance documentation. Locate them and confirm they are executed.
• Confirm each DPA includes the mandatory Article 28 provisions: processing only on documented instructions, confidentiality obligations, appropriate security measures, sub-processor restrictions and notification requirements, assistance with data subject rights and breach notification, deletion or return of data at contract end, audit rights.
• Maintain a list of all processors and their DPA status. Update it when you add new tools.
• Review sub-processors. Your ESP may use sub-processors for email delivery infrastructure. You are responsible for ensuring sub-processor agreements meet GDPR standards.

12. Records of processing activities

GDPR Article 30 requires controllers with more than 250 employees to maintain a RoPA. Organisations below that threshold must maintain records where processing is not occasional, is likely to result in a risk to data subjects or involves special category data. For any active ecommerce store, processing is not occasional, so a RoPA is effectively required regardless of size.

Checklist items for the RoPA:

• Create a RoPA that documents: name and contact details of the controller, purposes of processing, description of data subject categories, description of personal data categories, recipients, international transfers and their safeguards, retention periods, general security measures.
• Keep the RoPA current. Update it when you add new processing activities, new processors or change retention periods.
• Make the RoPA available to your supervisory authority on request. It is not publicly published but must be provided during an audit or investigation.

13. Ecommerce-specific scenarios

Beyond the core obligations, ecommerce operations involve specific use cases that each require careful GDPR consideration.

Abandoned cart emails: Sending abandoned cart emails requires a lawful basis. For existing customers in the EU, the "soft opt-in" rule under the ePrivacy Directive may apply if you gave them the opportunity to opt out at the time of purchase and they did not. For prospects who never completed a purchase and are not existing customers, you need prior consent. Check your platform's abandoned cart email configuration against this rule. See the guide on email marketing compliance for the full analysis.

Remarketing pixels: Meta Pixel, Google Ads remarketing tags, TikTok Pixel and similar tools set marketing cookies and transmit browsing data to advertising platforms. These require explicit prior consent under GDPR. Pixels must not fire until the user accepts the marketing cookie category. This applies to audience building, conversion tracking and lookalike audience creation. The third-party data sharing guide covers what data these pixels send and how to control it.

Loyalty programmes: Loyalty programmes typically involve extensive data collection: purchase history, points balances, redemption behaviour, communication preferences. The lawful basis is usually a combination of contractual necessity (running the programme) and consent (marketing communications). Make sure your loyalty programme terms clearly describe what data is collected and how it is used. If you share loyalty data with programme partners or use it for profiling, document the basis and disclose it.

Customer reviews and UGC:Product reviews and user-generated content may contain personal data. Ensure your privacy policy covers how review data is processed, how long it is retained and what happens to it if a reviewer requests erasure. Erasure of a review that contains the reviewer's data may need to be balanced against legitimate interests in maintaining genuine product feedback.

Personalisation and AI recommendations:Automated product recommendations based on browsing or purchase history constitute profiling under GDPR. If recommendations are purely based on a customer's own history and do not produce significant legal or similar effects, they may not require a DPIA. But if you use external AI tools that process data for personalisation, you need a processor agreement and your privacy policy must disclose the profiling.

14. Enforcement and fines

GDPR fines are tiered. Less serious violations (improper record-keeping, failure to appoint a DPO when required, missing processor agreements) carry fines up to 10 million euros or 2% of global annual turnover, whichever is higher. More serious violations (processing without a lawful basis, breach notification failures, violating data subject rights) carry fines up to 20 million euros or 4% of global annual turnover.

For a mid-market ecommerce store with 10 million euros in revenue, a 4% fine is 400,000 euros. The largest fines have been issued to large tech companies, but DPAs increasingly target mid-market operators. The Irish DPC, the CNIL, the Italian Garante and the Spanish AEPD are the most active enforcement authorities.

Beyond DPA-initiated enforcement, GDPR enables complaints from individuals and advocacy groups. The noyb organisation has filed complaints against hundreds of ecommerce stores using automated scanning. A single complaint can trigger a full DPA audit.

The most cost-effective approach to GDPR compliance is systematic implementation followed by continuous monitoring. Configuration drift is the primary risk: stores that were compliant when audited become non-compliant as new apps are installed, themes are updated and marketing stacks change. Automated scanning catches regressions before regulators do.

Frequently asked questions

Does GDPR apply to US ecommerce stores?

Yes. GDPR applies to any store that offers goods or services to individuals in the EU, or that monitors their behaviour. If your store ships to EU countries, accepts EU payment methods or runs remarketing campaigns targeting EU users, GDPR applies regardless of where your business is incorporated.

What lawful basis should an ecommerce store use for order processing?

Order fulfilment uses contractual necessity as the lawful basis. Processing a customer's name, address and payment details to fulfil their order does not require consent. Marketing to that customer after the sale typically requires either consent or a legitimate interest assessment, depending on the channel and jurisdiction.

How long does an ecommerce store have to respond to a data subject access request?

Under GDPR Article 12, you must respond to a DSAR within one month. The deadline can be extended by two additional months for complex or numerous requests, but you must inform the person of the extension within the first month. Failure to respond within the deadline is itself a GDPR violation.