GDPR for Online Shops
An online shop handles more personal data than most small websites: names and addresses for delivery, emails for receipts, account passwords, order histories, payment references, reviews, and the advertising pixels that measure every sale. Each of these has its own rules, and they meet at the checkout.
This guide follows a customer from the product page to the months after delivery, and shows what a UK shop needs to do at each point, with settings for Shopify and WooCommerce. It is general guidance, not legal advice.
Where personal data enters an online shop
It helps to picture a single order and follow it. Take a fictional shop, Wrenfield Ceramics, selling handmade mugs across the UK.
| Stage | Data involved | Usual lawful basis | Rules to watch |
|---|---|---|---|
| Browsing and basket | Cookies, device data, basket contents | Strictly necessary for the basket; consent for analytics and advertising unless an exemption applies | PECR consent before tracking |
| Checkout | Name, delivery and billing address, email, phone, order details | Contract | Collect only what fulfilment needs |
| Payment | Card details, handled by the payment provider | Contract; the provider also has its own legal duties | Keep card data off your own systems |
| Delivery | Name, address, phone or email passed to a courier | Contract, or legitimate interests for delivery updates | Tell customers the courier receives their details |
| After the sale | Order record, invoice, returns, reviews | Legal obligation for accounting; contract for returns; legitimate interests or consent for reviews | Retention periods; marketing rules for follow-up emails |
| Marketing | Email address, purchase history, preferences | Consent, or the soft opt-in under PECR | An easy opt-out in every message |
The bases above are typical, not automatic. Choose and record your own for each purpose. This guide is not legal advice; shops selling age-restricted goods, health products or to children should take specialist advice on the extra rules that apply.
The checkout: collect less, explain more
The data minimisation principle says you should collect what you need for the purpose and no more. At checkout, that turns into practical questions:
- Phone number. Is it needed? Couriers often want one for delivery problems, but if you do not pass it on or use it, make it optional or remove it.
- Date of birth. Only needed for age-restricted products. Do not ask everyone for it "for birthday offers" as a required field.
- Title and gender. Rarely needed to deliver a parcel. Remove them or make them optional.
- Account creation. Forcing a customer to create an account to buy once keeps more data for longer than the purchase needs. Offer guest checkout.
- "How did you hear about us?" Fine as an optional question, but it should not be required to complete an order.
Next to the checkout form, add a short line explaining what happens to the details, with a link to the privacy policy. Customers should not have to agree to the privacy policy to buy, because most order processing is based on contract and legal obligation, not consent. A statement that they can read it is enough.
Marketing emails: consent and the soft opt-in
Email marketing to individuals is governed by PECR as well as the UK GDPR. The general rule is that you need consent. PECR also contains an exception that suits shops well, known as the soft opt-in. You may email existing customers about your own similar products without separate consent if all of these are true:
- You got the email address in the course of a sale, or negotiations for a sale, of a product or service.
- You are marketing your own similar products or services, not those of other businesses.
- You gave the customer a clear, simple chance to refuse marketing when you collected the address, for example an unticked box saying "Do not send me offers" or a clear opt-out option at checkout.
- Every marketing message includes a simple, free way to opt out.
People who sign up for your newsletter without buying anything are not covered by the soft opt-in. For them, use a clear, unticked opt-in box and keep a record of when and how they agreed.
Follow-up emails that may count as marketing
- Order confirmations and dispatch notices are service messages, not marketing, as long as they do not carry promotions.
- Abandoned basket reminders encourage a purchase, so many shops treat them as marketing and only send them where the customer has opted in or the soft opt-in applies. Check the ICO's current guidance on direct marketing if you are unsure.
- Review requests can be treated as marketing too, especially if they include offers or product suggestions. Keep them plain, and respect opt-outs.
- A promotional block in a receipt can turn a service message into a marketing message. Keep receipts clean for customers who opted out.
Shopify and WooCommerce settings to check
Shopify
- Customer privacy settings. Set up the cookie banner and region settings, or connect a consent app that uses Shopify's customer privacy API, so apps and pixels receive the visitor's choice.
- Email marketing at checkout. In the checkout settings, show the marketing sign-up option and make sure it is not preselected.
- Customer data requests. From a customer's page in the admin you can request their data or request erasure. Shopify runs erasure after a delay, and keeps order records needed for legal reasons. Apps you have installed receive the request too, but check each app handles it.
- Apps. Each app with access to customer data is a supplier. Review the list, uninstall ones you do not use, and check the data terms of those you keep.
WooCommerce
- Accounts and Privacy settings. Under WooCommerce settings, you can allow guest checkout, set whether accounts are created automatically, add privacy policy text near the checkout, and set retention periods for inactive accounts and for cancelled, failed, pending and completed orders.
- WordPress personal data tools. Under Tools, the Export Personal Data and Erase Personal Data screens handle access and erasure requests, including WooCommerce order data where the retention settings allow it.
- Extensions. Marketing, review and product feed extensions often add tracking or send data to third parties. Check each one's settings for consent integration.
Other platforms have equivalents under names such as customer data, privacy or compliance. The principle is the same: use the platform's built-in tools for requests and retention, and test that they work.
The fix, step by step
Step 1
Map the customer journey and every tool in it
Place a test order on your own shop and note every point where personal data is entered, sent or stored: basket, checkout, payment page, confirmation email, courier notification, review request and any marketing sign-up. List each app, plugin, payment provider, courier, email platform and advertising pixel involved, what data it receives, where it is based and your lawful basis. This list drives every other step, including the privacy policy.
Step 2
Trim the checkout to what the order needs
Go through each checkout field and ask whether the order can be fulfilled without it. Remove or make optional fields such as title, gender, date of birth and a second phone number unless you genuinely use them. Turn on guest checkout so account creation is a choice. Add a short line near the order button explaining how the details are used, with a link to the privacy policy, instead of a required agreement tick box.
Step 3
Separate marketing permission from the purchase
Make sure the marketing option at checkout is unticked and optional, and that the wording tells customers what they will receive. If you rely on the soft opt-in for customers, give a clear chance to refuse at checkout and an unsubscribe link in every email. Use a separate, recorded opt-in for newsletter sign-ups from non-customers. Check abandoned basket and review emails only go to people whose permission covers them.
Step 4
Configure your platform's privacy and retention settings
In Shopify, set up the customer privacy settings or a consent app that uses the customer privacy API, and review which apps can access customer data. In WooCommerce, open the Accounts and Privacy settings, enable guest checkout, and set retention periods for inactive accounts and each order status. On any platform, practise an export and an erasure on a test customer so you know the process works before a real request arrives.
Step 5
Put ad pixels and recommendation tools behind consent
Shops commonly run several advertising pixels, a product feed integration, reviews widgets and personalised recommendations. Open a private window, browse to a product and the basket without accepting cookies, and check which of these send requests or set cookies. Move each one behind the matching consent category using the platform's customer events, your consent tool or Tag Manager, and remove duplicate pixels installed by both an app and the theme.
Step 6
Set retention for orders, accounts and baskets
Decide how long to keep each kind of record. Accounting records such as invoices are generally kept for six years for HMRC. Customer accounts with no activity for a set period, such as three years, can be deleted or anonymised. Abandoned baskets and failed payments rarely need keeping for more than a few weeks. Record the periods in the privacy policy, configure them in the platform, and set reminders for anything that must be done by hand.
Step 7
Prepare for customer requests and incidents
Customers ask shops for their data, for corrections and for account deletion more often than most businesses expect. Write down who handles these, how you confirm identity using details you already hold, and where the one-month deadline is tracked. Do the same for incidents such as a compromised admin account or a leaked customer export. Then run the GDPR Audit again to confirm the visible issues have cleared.
A retention schedule for a typical shop
The periods below are examples for a small UK shop. They are not fixed legal periods, apart from where tax and accounting rules set a minimum, and you should adapt them to your business and record your reasons.
| Record | Example period | Reason |
|---|---|---|
| Invoices and order records needed for accounts | 6 years from the end of the financial year | Tax and accounting duties |
| Customer account with no orders or logins | 3 years of inactivity, then delete or anonymise | No ongoing need once the relationship has lapsed |
| Abandoned baskets and failed payments | 30 to 90 days | Enough to resolve problems; little value after that |
| Returns and complaints correspondence | Until the matter closes, plus a period for possible claims | Handling disputes |
| Marketing list entries | Until the person unsubscribes, then a minimal suppression entry | Suppression stops you emailing them again by mistake |
| Product reviews | While the product page is live, unless the reviewer asks for removal | Published content the reviewer chose to share |
Anonymising is often better than deleting for orders past their retention date: remove the name, email and address but keep the product, date and value, so your sales reports still work.
Where the other GDPR fixes fit in
A shop touches almost every area the GDPR Audit checks, and each has its own guide:
- The banner itself, including a Reject all button and categories, is covered in fixing cookie consent banners.
- Pixels and tags that fire too early are covered in fixing tracking before consent.
- Couriers, payment providers and apps outside the UK are covered in fixing international data transfers.
- What your notice must say about all of the above is in fixing an incomplete privacy policy.
For the search and product-page side of running a shop, the Ecommerce Audit Guide covers what our ecommerce tools check.
1. Can I email customers who bought from me without asking for consent?
Often yes, under the soft opt-in in PECR, but only if the conditions are met. You must have got the address during a sale, market only your own similar products, have given a clear chance to refuse when you collected the address, and include an easy opt-out in every message. If you did not offer that chance to refuse at checkout, the soft opt-in does not apply, and you need consent before sending marketing.
2. Are abandoned basket emails allowed under UK rules?
They can be, but treat them with care. An abandoned basket reminder encourages someone to buy, so it may well be direct marketing, which needs consent or the soft opt-in. A common approach is to send reminders only to people who have opted in or who are existing customers covered by the soft opt-in and did not refuse. Check the ICO's current direct marketing guidance, and always include an easy way to stop the emails.
3. Do customers have to tick a box agreeing to my privacy policy at checkout?
No, and it can cause confusion. Most processing for an order is based on the contract and your legal duties, not consent, so you do not need agreement to the privacy policy. What you need is to tell customers, at the point of collection, how their data is used, which a short sentence and a link near the order button achieves. Keep any tick box for marketing permission, and leave it unticked.
4. How long should an online shop keep order data?
Records needed for accounting and tax are generally kept for six years from the end of the financial year to meet HMRC requirements. Other data, such as inactive customer accounts, abandoned baskets and old delivery details, should have shorter periods tied to their purpose. After the accounting period ends, anonymising orders by removing names and contact details keeps your sales figures while reducing the personal data you hold. Write the periods into your privacy policy and configure them in the shop platform.
5. What happens when a customer asks me to delete their account?
Delete or anonymise the data you no longer need, and explain what you must keep and why. You can usually keep order and invoice records needed for tax and accounting, and a minimal suppression entry so you do not email them again, while deleting the account, saved addresses and marketing data. Shopify and WooCommerce both have tools for this. Respond within one month and tell the customer what you have done.
6. Is my payment provider a processor or a controller?
It depends on the provider and the activity. Major payment providers often describe themselves as independent controllers for much of their processing, such as fraud prevention and meeting their financial regulatory duties, and as processors for some other services. Read their data protection terms to see which role they claim. Either way, mention them in your privacy policy, and check the transfer basis if data is handled outside the UK.
7. Do I need consent for Shopify or WooCommerce analytics?
The built-in analytics that platforms use to run the shop and produce your sales reports are usually handled by the platform itself, but tracking cookies and third-party analytics still fall under PECR. Advertising pixels need consent. For analytics, the Data (Use and Access) Act 2025 adds a limited exemption for statistics used to improve a service, with conditions. Check the ICO's current guidance and your platform's consent settings before treating any analytics as exempt.
The GDPR Audit checks what a visitor can see: the cookie banner, the scripts that load before consent, the privacy policy and the routes people have to exercise their rights, and lists each finding with the guide that fixes it.
Open GDPR Fixes →