By business type

GDPR Policy Generator for e-commerce

Written for checkout data, payment hand-offs, marketing consent and cross-border selling.

Generate your GDPR policy Read the GDPR policy guide

For a store, GDPR accountability lives or dies on one distinction: order processing under contract versus marketing under consent. Almost every enforcement story in retail starts with the two being merged so that a purchase silently became a marketing permission.

An online store collects more categories of personal data than almost any other small business, and it collects them at the highest-stakes moment: checkout. Name, address, phone, email, order contents, payment token, device identifiers and behavioural history all arrive in one flow, feeding a dozen downstream systems.

The marketing layer is where most stores go wrong. Abandoned cart emails, review requests, loyalty programmes and retargeting all reuse data collected to fulfil an order. Each of those is a distinct purpose, and in the UK and EU each needs its own basis - which is usually consent or the narrowly-defined soft opt-in, not the contract basis that covers the order itself.

Selling across borders multiplies everything. Every market adds a consumer law, a cancellation regime and a set of disclosure duties, and shipping internationally means transmitting customer data to carriers and customs authorities in each destination.

What a GDPR policy for an online store has to cover

Separate records of processing for fulfilment, marketing, analytics and fraud prevention
Consent evidence for marketing, with the wording and timestamp retained per subscriber
A DPIA where you profile customers for personalisation or dynamic pricing
Processor terms with payment, fulfilment, review and email providers
Retention split between transaction records held for tax and profiles held for marketing

How an online store actually moves personal data

Checkout data

Collected under contract, but the fields you add beyond what fulfilment needs - date of birth, gender, marketing preferences - are on a different footing.

Payment tokens and fraud scoring

The gateway processes card data as its own controller for fraud prevention, which is a hand-off, not a straightforward sub-processing.

Abandoned cart capture

An email address entered but never used to complete an order. Using it is direct marketing, and whether the soft opt-in applies is genuinely debatable because no sale happened.

Retargeting and lookalike audiences

Uploading customer lists to ad platforms for matching or audience building is a disclosure to a third party and, in California, likely sharing.

Reviews and post-purchase requests

Review platforms receive customer name, email and order data, and typically publish part of it.

Cross-border shipping and customs

Address and contents data transmitted to carriers, customs brokers and destination authorities.

Third parties the draft will ask you about

Stripe · PayPal · Klarna · Klaviyo or Mailchimp · Trustpilot or Judge.me · Meta and Google Ads · DPD, Royal Mail or your carrier · Gorgias or Zendesk

The rules that apply

Distance selling and cancellation rules

Fourteen days in the UK and EU, seven in Brazil, none federally in the US - the same store faces different obligations per market.

Marketing consent and the soft opt-in

Post-purchase marketing is permitted only where the address was collected in a sale of similar goods with an opt-out offered at the time and in every message.

Cookie and tracking consent

Retargeting pixels, analytics and personalisation all require consent in the UK and EU before they fire.

Payment card handling

Using a hosted gateway keeps card data off your systems, but the policy has to describe the hand-off accurately rather than implying you store nothing at all.

Consumer information duties

Total price, delivery costs, return costs, complaint routes and trader identity, disclosed before the order is placed.

What the generated GDPR policy contains

Article 13 and 14 transparency notice
The full disclosure set, split by whether the data came from the person or from somewhere else.
Lawful basis register
Every processing activity mapped to one of the six bases, with the legitimate interests assessment written down where you rely on that basis.
Records of processing (Article 30)
The internal register a supervisory authority can ask for at any time, covering purposes, categories, recipients, transfers and retention.
Data subject rights procedure
How a request arrives, how identity is verified, who handles it, and the one-month clock with its two-month extension.
International transfer mechanism
Adequacy, SCCs with a transfer impact assessment, or the UK IDTA/addendum - named per destination, not asserted in general.
Breach detection and 72-hour notification
The internal escalation path, the assessment test, and the template for notifying the regulator and, where required, the individuals.
Processor and sub-processor controls
Article 28 terms, the sub-processor list, and the change-notification commitment your customers will ask for.

The e-commerce document set

Map the checkout field by field
For each field: why it is collected, the basis, where it goes and how long it is kept.
Separate order processing from marketing
Different purposes, different bases, different retention. The consent record for marketing has to be independent.
Scan the storefront for pre-consent tags
Retargeting pixels are the usual finding.
Write the refund policy against every market you ship to
Statutory rights first, then your own terms.
Document the payment hand-off
Which provider, which fields they see, and what you retain.
Set retention for orders and for marketing profiles separately
Tax retention is not a reason to keep a behavioural profile.

Where this usually goes wrong

Abandoned cart emails without a basis

Where no purchase completed, the soft opt-in argument is weak. Consent captured at the point of email entry is the defensible route.

Pre-ticked marketing checkboxes

Invalid consent in the UK and EU, and it taints the whole list rather than just the individual record.

Customer list uploads to ad platforms undisclosed

It is a disclosure to a third party and in several US states a sale or share requiring an opt-out.

Retargeting pixels firing before consent

The most common UK and EU failure on e-commerce sites, and the one a cookie scan finds in seconds.

A returns policy that contradicts statutory rights

Final sale rules that override cancellation rights are unenforceable and, in several markets, independently actionable.

Order data retained forever

Tax records justify a period for the transaction data, not for marketing profiles and behavioural history attached to it.

Frequently asked questions

Do I need a privacy policy for a small online shop?

Yes. Taking an order always involves personal data, which triggers transparency obligations in every major market, and payment providers and marketplaces require a published policy as a condition of service.

Can I email customers after they buy?

In the UK and EU, only under the soft opt-in: your own similar products, to someone who bought from you, with an opt-out offered at collection and in every message. Otherwise you need consent.

Are abandoned cart emails allowed?

They are direct marketing, and where no purchase completed the soft opt-in is difficult to rely on. Capturing explicit consent at the point of email entry is the safer route.

Do I need a cookie banner for an online shop?

If you serve the UK or EU and run analytics, retargeting or personalisation - which nearly every store does - then yes, and it needs to block those tags until consent.

Does GDPR apply to a business outside the EU?

Yes, where you offer goods or services to people in the EU or monitor their behaviour. Article 3(2) is about where the person is, not where you are - and Article 27 may also require you to appoint an EU representative.

What is the difference between EU GDPR and UK GDPR?

The text is nearly identical, but they are separate laws with separate regulators, separate fine ceilings in different currencies, and separate transfer regimes. A business serving both needs both named, not "GDPR" as shorthand.

Do I need a Data Protection Officer?

Only where your core activities involve large-scale regular monitoring or large-scale special-category data, or you are a public authority. Many businesses do not need one - but if you do not have one, say who is accountable instead.

Is a GDPR policy the same as a privacy policy?

No. The privacy policy is the outward-facing notice. The GDPR policy set is the internal machinery - lawful basis register, ROPA, rights procedure, breach plan - that lets you answer a regulator when they ask how the notice is honoured.