There are many myths and jokes circulating about GDPR, but do you really know what it is about? In today’s article, we will break down what complying with GDPR means for e-shops.
There are many regulations, laws, and directives that e-shop operators must follow if they want to avoid penalties. One such regulation that we definitely do not recommend neglecting is GDPR.
What is GDPR?
GDPR is a European Union regulation dealing with personal data protection and has applied to all EU member states since 2018. This regulation defines how personal data may be collected, stored, and further processed. It does not apply only to e-shops, but to all areas where personal data is handled.
What is considered personal data under GDPR?
Under GDPR, personal data includes any information that can be used to identify a person. For example:
- first and last name
- home address
- email address containing a name and/or surname
- ID card number, business identification number, etc.
- location data (e.g., mobile phone location information)
- IP address
- data from non-essential cookies
- photographs of individuals
On the other hand, an email address such as [email protected] or a company identification number is not considered personal data.
What must an e-shop include to comply with GDPR?
From the examples above, it is clear that e-shops work with customers’ personal data and must therefore comply with GDPR. For a standard e-shop, GDPR mainly concerns the following areas.
Cookies
The first thing you encounter on most websites is a request for consent to use cookies. The reason is GDPR, as apart from strictly necessary technical cookies, all other cookies are subject to GDPR.
If you want to use cookies for marketing, analytics, or other non-technical purposes, visitors must immediately be given the opportunity to accept or reject them.
Most websites address this using information bars or pop-ups, which must follow these rules:
- consent or refusal must be equally easy
- consent must not be pre-ticked (e.g., pre-checked box or toggle)
- the bar or pop-up must not prevent use of the website without granting consent
- non-essential cookies may not be used before consent is given
- visitors must have access to information about personal data processing before making a decision
Many websites still fail to handle this correctly by making rejection more difficult, visually highlighting the consent button more prominently, pre-selecting consent, or even using cookies without consent. As with other violations, such practices can lead to significant penalties (see below).
Note: This article does not replace professional legal advice.