# Checklist: data protection in online stores Source: https://conformitate.md/en/resources/checklist-online-stores Updated: 2026-10-16 Free checklist An online store needs a legal basis for each purpose for which it processes its customers’ data (art. 6), from fulfilling orders to sending the newsletter. The checklist helps you check whether you inform customers, can demonstrate their consent, respect objections to direct marketing and have your providers process the data under the conditions of the law. 11 check questions, each with its article of the law Tick what you already have. You see at once what is missing against the basic requirements of Law 195/2024 and which package closes the gaps. 1. Do you have a legal basis for each purpose for which you process customers’ data: fulfilling the order, delivery, the newsletter, analysing visits to your website? [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") 2. Do you ask customers only for the data the purpose requires, for example only the data you need for the order and delivery? [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") 3. When their data is collected, do customers receive the information the law requires: who processes their data, for what purposes and on what legal basis, to whom you disclose it, how long you keep it and what rights they have? [art. 12](https://conformitate.md/en/law-195-2024/article-12 "Transparency of information, communications and modalities for the exercise of the rights of the data subject") [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") 4. Where processing is based on consent, for example for the newsletter, can you demonstrate that the customer gave it, and can the customer withdraw it as easily as they gave it? [art. 7](https://conformitate.md/en/law-195-2024/article-7 "Conditions for consent") 5. Do you bring the right to object to direct marketing to customers’ attention at the latest at the first communication, clearly and separately from other information, and stop sending marketing messages to those who have objected? [art. 21](https://conformitate.md/en/law-195-2024/article-21 "Right to object") 6. Do you have a written contract with every provider that processes customers’ data on the store’s behalf, such as your hosting provider or email marketing platform? [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") 7. Do you transfer customers’ data to a state outside the European Economic Area only under the conditions of the law, for example on the basis of a decision on the adequacy of the level of protection or of appropriate safeguards? [art. 44](https://conformitate.md/en/law-195-2024/article-44 "General principle for transfers") [art. 45](https://conformitate.md/en/law-195-2024/article-45 "Transfers on the basis of a decision on the adequacy of the level of protection") [art. 46](https://conformitate.md/en/law-195-2024/article-46 "Transfers on the basis of appropriate safeguards") 8. Are your security measures for customer accounts, the order database and staff access to them appropriate to the risk? [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") 9. Can you respond to customers’ requests for access to, rectification or erasure of their data without undue delay and within one month of receipt, extending that period only under the conditions of the law? [art. 12](https://conformitate.md/en/law-195-2024/article-12 "Transparency of information, communications and modalities for the exercise of the rights of the data subject") [art. 15](https://conformitate.md/en/law-195-2024/article-15 "Right of access by the data subject") [art. 16](https://conformitate.md/en/law-195-2024/article-16 "Right to rectification") [art. 17](https://conformitate.md/en/law-195-2024/article-17 "Right to erasure (‘right to be forgotten’)") 10. Do you keep a written record of processing activities? The exemption for organisations with fewer than 250 employees does not apply where the processing is not occasional or is likely to result in a risk to customers. [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") 11. Do you document every personal data breach affecting customers’ data, and do you know when the National Centre for Personal Data Protection must be notified? [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") Industry [Online stores](https://conformitate.md/en/industries/online-stores) --- Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57 Phone: +373 767 27 667 · Email: contact@conformitate.md Prices: https://conformitate.md/en/pricing