To make sure your shop is compliant with the GDPR, a privacy policy is a must. But there are some other rules that you must also consider. These rules relate to:

• Web forms

• Website encryption

• Email marketing

• Cookies

• Social media plugins

Web forms

When a customer wants to enter their personal data on your site (for example, during checkout or when signing up for your newsletter), they need to fill in a web form. To ensure that the web forms on your site comply with the GDPR, they must meet two important requirements: 

• Data minimisation: As a shop operator, you are only allowed to request the minimum amount of data necessary for you to fulfil your contractual obligation (for example, to fill an order). So, during checkout, all you really need to ask is the customer’s name and address. If your customer only wants to sign up for your email newsletter, you cannot require them to also provide you with their postal address and phone number. 

• Confidentiality: As an online retailer, you are obligated to make sure that all your customers’ personal data is protected from unauthorised or unlawful processing. That means that any transfer of data needs to be encrypted.

Website encryption

Article 32.1.a of the GDPR requires shop operators to ensure that their data transfer is encrypted. It’s a good idea to use the HTTPS protocol to secure communications on your website. You can also use an SSL certificate to ensure that…

• … communication partners are authorised via an asymmetrical encryption process.

• … data transfer is secured end-to-end with a symmetrical encryption process.

• … the integrity of the transported data is not compromised.

To learn more about how to obtain an SSL certificate and which other security measures you can take, check out our article on eCommerce security.

Email marketing

Ever since the GDPR came into effect, online shops have been required to use a double opt-in process to gain the customer’s consent for processing their data (for example, when a customer signs up for your newsletter). That means a customer who is interested in receiving information or advertising from you must consent to this when they give you their contact information (for example, by ticking a box to indicate that they wish to receive advertising emails from you). After that, you must also send them a confirmation link via email, which they must click to complete the sign-up process. This means that they twice give their consent to receive future information/offers from you. If you don’t obtain this double consent, you are not allowed to send advertising or marketing messages to the customer’s email address. If the customer does not click on the confirmation link, you are not allowed to use or store their email address for marketing purposes. 

Cookies

Cookies are another important topic when it comes to data security. Many online shops use cookies to create a more user-friendly experience. For example, cookies can store information so users do not have to fill in their details every time they visit the site. These include information such as:

• Language settings

• Items in the shopping cart

• Login details

The EU Cookies Directive (2009/136/EC) is another piece of legislation that is closely related to the GDPR. Under this directive, a shop owner can only use cookies without the visitor’s consent if they are strictly necessary from a technical point of view. In addition, your website must always include a banner that informs visitors that it uses cookies. And you must always ask for the visitor’s consent in advance of using cookies that are not necessary to keep your site functioning properly.

The table below shows examples of which kinds of cookies are considered technically necessary and which are not:

Social media plugins

In the past, social media plugins could start collecting user data the moment a visitor arrived on your site. The GDPR changed all of that. Under the new rules, social media plugins must always be inactive by default when a user arrives on a site. When a plugin is correctly embedded on your site, it is a passive button that only becomes active when the user clicks on it. By clicking the button, the user gives their consent for their data to be transferred to whichever social media platform the plugin is for. After all, if a user clicks the button, it’s logical to assume that they wish to use it (for example, to share content from your website via social media).

Social media plugins are very common in e-commerce and usually appear in the form of Shariff buttons. In addition, you can use a two-click consent principle for social media buttons on your site (similar to the double opt-in principle for newsletters). Under the two-click system, the user first clicks the social media button they want to use. Then your shop explicitly asks if they consent to you transferring their data to the social media platform.

Order processing

As a shop operator, you probably work with many service providers, such as:

• Payment service providers

• SaaS suppliers

• Cloud services

These service providers also process personal data related to your customers, so the GDPR requires you to enter into a data processing agreement (DPA) with each partner. Without a DPA, you have no legal grounds for transferring customer data to a third party. Although creating a DPA takes a little extra effort, it offers you more security than you had in the past. For example, a DPA clearly defines who is responsible in the event of a data leak.