Key points
- The GDPR (General Data Protection Regulation), applicable since 25 May 2018, defines personal data in Article 4 as any information relating to an identified or identifiable natural person.
- Consent is one of the six legal bases set out in Article 6 of the GDPR; where it is required, it must be freely given, specific, informed and unambiguous (Article 4(11)).
- Compliance requires clear information for individuals (Article 13) and, in the cases set out in Article 37, the appointment of a data protection officer (DPO).
- The record of processing activities (Article 30) sets out, in particular, the purposes, the categories of data subjects and of data, the recipients and, where possible, the security measures; it is used during inspections by the authority.
- Article 5(1)(e) of the GDPR limits the storage of data to the period necessary for the purposes pursued.
- Security relies on technical and organisational measures: encryption, firewalls and regular audits to detect vulnerabilities.
Your personal data are valuable, and protecting them is a daily concern. You have heard of the GDPR, but the related obligations and risks remain unclear. How can you achieve compliance without wasting precious time on complex procedures? You are looking for clear, practical answers you can apply straight away.
Collecting email addresses, online payments, the legal notice: every step comes with strict rules. One mistake, and the consequences can be serious. You need a simple guide to understand these requirements and act effectively.
Below, discover the key principles of the GDPR, its practical impact and the good practices suited to your business. Protecting your customers’ data is not an option; it is a necessity. You deserve accessible explanations and pragmatic solutions.
Understanding the GDPR and its implications
What is the GDPR?
The GDPR, or General Data Protection Regulation, has applied since 25 May 2018 (Article 99). It was designed to harmonise data protection laws across Europe, giving citizens more control over their personal information and imposing significant obligations on organisations that process such data. Under Article 4 of the GDPR, “personal data” means any information relating to an identified or identifiable natural person.
The main objectives of the GDPR
The GDPR’s main aims are:
- To protect individuals’ rights regarding the confidentiality of their data.
- To make organisations accountable for their use of personal data.
- To introduce severe penalties for breaches of the established rules.
GDPR obligations for e-commerce businesses
Obtaining user consent
Consent is one of the six legal bases for processing personal data (Article 6 of the GDPR). Where it is required, for example for email marketing to consumers, it must be “freely given, specific, informed and unambiguous” and result from a statement or a clear affirmative action (Article 4(11)). Article 7 also requires the controller to be able to demonstrate this consent. Users must therefore know exactly what they are consenting to, why their data are collected and how they will be used.
Privacy policy and legal notice
A clear and transparent privacy policy is essential. It must explain which data are collected, how long they will be kept, who they will be shared with and how they are protected. Where applicable, it also gives the contact details of the data protection officer (DPO) (Article 13(1)(b) of the GDPR), which the controller must also publish (Article 37(7)). The website’s legal notice, for its part, is governed by Article 1-1 of Law No. 2004-575 of 21 June 2004 on confidence in the digital economy (loi pour la confiance dans l’économie numérique, LCEN). For detailed advice on bringing your online privacy policy into compliance, see our guide on how to bring your terms into compliance.
Keeping a record of processing activities
The record of processing activities is kept by each controller (Article 30 of the GDPR). Organisations with fewer than 250 employees are exempt, unless the processing is likely to result in a risk to individuals, is not occasional or involves sensitive data or data relating to criminal convictions (Article 30(5)); the day-to-day management of a customer file is, in principle, not occasional. This record must include, in particular:
- The purposes of the processing.
- The categories of data subjects.
- The recipients of the data.
- A general description of the security measures, where possible.
This helps data protection authorities check GDPR compliance during an inspection.
In practice: concrete tips for your e-commerce website
Data security
The security of personal data is paramount. You must implement appropriate technical and organisational measures to protect information against loss, alteration or unauthorised access. For example, encrypt sensitive data, use robust firewalls and carry out regular audits to detect any vulnerabilities. If you need advice on these questions, do not hesitate to consult a GDPR lawyer in Paris.
Limiting data retention
Keep data for as long as necessary to achieve the purposes for which they were collected. The general rule, drawn from Article 5(1)(e) of the GDPR, is not to keep information longer than necessary. Introducing a policy of regularly deleting old data can help minimise risks and ensure GDPR compliance.
Informing users of their rights
Users have several rights under the GDPR, including the right of access, rectification, erasure (right to be forgotten), restriction of processing and data portability. You should inform your customers of these rights and put in place easy mechanisms for them to exercise them.
Examples of good practice in e-commerce
Contact forms and newsletter sign-ups
E-commerce websites still commonly offer contact forms and newsletter subscriptions. Make sure that:
- Consent boxes are not ticked by default.
- You state clearly the purpose for which email addresses are collected.
- You offer a simple way to unsubscribe easily.
Selling products and handling online payments
When you handle online payments, make sure you use GDPR-compliant providers. Protect transactions with robust security protocols such as SSL/TLS. In addition, never store customers’ credit card details without valid reasons and without taking appropriate security measures.
| Good practice | Description |
|---|---|
| Use of opt-in buttons | Make sure that every form where data are collected contains a clear option inviting the user to agree specifically to the proposed use of their data. |
| Regular audits | Carry out regular security and data protection audits to ensure ongoing compliance with the GDPR. |
FAQs: frequently asked questions on GDPR compliance and e-commerce
How can I obtain my customers’ consent?
What should I do if I suffer a data breach?
Do I need to appoint a DPO for my e-commerce business?
What are the main fines under the GDPR?
This page provides general information and does not constitute legal advice: every situation is different. For a specific matter, see our e-commerce lawyer page.
