Checklist: data protection in online stores

☐ Do you have a legal basis for each purpose for which you process customers’ data: fulfilling the order, delivery, the newsletter, analysing visits to your website? art. 6

☐ Do you ask customers only for the data the purpose requires, for example only the data you need for the order and delivery? art. 5

☐ When their data is collected, do customers receive the information the law requires: who processes their data, for what purposes and on what legal basis, to whom you disclose it, how long you keep it and what rights they have? art. 12art. 13

☐ Where processing is based on consent, for example for the newsletter, can you demonstrate that the customer gave it, and can the customer withdraw it as easily as they gave it? art. 7

☐ Do you bring the right to object to direct marketing to customers’ attention at the latest at the first communication, clearly and separately from other information, and stop sending marketing messages to those who have objected? art. 21

☐ Do you have a written contract with every provider that processes customers’ data on the store’s behalf, such as your hosting provider or email marketing platform? art. 28

☐ Do you transfer customers’ data to a state outside the European Economic Area only under the conditions of the law, for example on the basis of a decision on the adequacy of the level of protection or of appropriate safeguards? art. 44art. 45art. 46

☐ Are your security measures for customer accounts, the order database and staff access to them appropriate to the risk? art. 32

☐ Can you respond to customers’ requests for access to, rectification or erasure of their data without undue delay and within one month of receipt, extending that period only under the conditions of the law? art. 12art. 15art. 16art. 17

☐ Do you keep a written record of processing activities? The exemption for organisations with fewer than 250 employees does not apply where the processing is not occasional or is likely to result in a risk to customers. art. 30

☐ Do you document every personal data breach affecting customers’ data, and do you know when the National Centre for Personal Data Protection must be notified? art. 33