An online shop is usually a Data Fiduciary for its customers’ data. Review what you collect at checkout, which cookies and tracking pixels run on your site, who receives data (payment gateway, couriers, marketing tools) and how you handle marketing messages, requests and breaches. Most duties are scheduled from 13 May 2027, so use the time to map data and fix notices.
- Customer, delivery and payment data all count as personal data.
- Marketing pixels, abandoned-cart messages and WhatsApp updates need a clear purpose and notice.
- Couriers, gateways and plugins are processors, so keep a list of them.
Where an online shop collects personal data
| Where | Typical data | Review |
|---|---|---|
| Checkout and accounts | Name, address, phone, email, order history | Collect only what the order needs; show a clear notice |
| Payments | Handled by a gateway; you may see order and partial card details | Know what the gateway shares with you and what you store |
| Delivery and returns | Address, phone, delivery notes | List courier partners and what they receive |
| Marketing | Email, phone, browsing and cart data | Consent and purpose for newsletters, SMS and WhatsApp |
| Website analytics and ads | Cookie and device identifiers | Know which pixels and scripts run, and tell visitors |
| Reviews and support chats | Name, order details, messages | Decide how long to keep them |
Cookies, pixels and tracking
Most shops run analytics and advertising scripts. List every script on your site, including those added by themes and plugins, note what each collects and why, and make sure your notice says so. A consent banner can help where your use needs consent. For an approach that suits your setup, see our services.
Marketing messages and abandoned carts
Reminders and promotional messages should have a clear purpose and an easy way to opt out. Do not use a number collected for delivery updates for unrelated promotions without telling the customer. See our WhatsApp guide.
Gateways, couriers and apps
Payment gateways, couriers, CRMs, email tools and shop plugins all handle your customers’ data. Keep a register of each one, what it receives and who manages it, and make sure your contracts cover security and prompt notice of incidents. A vendor’s breach can still be your responsibility.
Keeping and deleting data
Invoices and tax records must be kept for the periods the law requires, but marketing lists, old carts and unused accounts usually do not need to be kept indefinitely. Set a rule for each type of data and write it down. When a customer asks you to erase their data, explain what you must keep and why.
A starting checklist
- Write down every place you collect customer data.
- List every script, pixel and plugin on your site.
- Check your checkout and signup notices.
- List your gateways, couriers and marketing tools.
- Name someone who handles customer requests.
- Prepare a simple breach response plan.
Frequently asked questions
Does a small Instagram or WhatsApp shop need to worry?
If you collect customers’ names, phone numbers and addresses to take orders, you are handling personal data. The Act has no blanket exemption for small size, although some classes, such as startups, may be notified for relaxed treatment. Check whether any notification covers you.
Does the payment gateway take care of everything?
The gateway is responsible for its own processing of card data, but you remain responsible for the personal data you collect, store and share, so it still needs to be in your map.
Do I need a cookie banner?
It depends on what your site collects and why. Where tracking relies on consent, a banner is a practical way to ask for it. Review your scripts first.
Sources
Reviewed 3 November 2026. This is general information, not legal advice. Dates and details can change, so check the official sources.