Every online order is also a data transaction. A customer hands you their name, address, email, payment details and, increasingly, a trail of behaviour — what they browsed, what they abandoned, what made them buy. Layer marketing, analytics and personalisation on top, and even a modest online store is processing a surprising amount of personal data through systems it didn’t build and doesn’t fully control. UK data protection law applies to all of it, and the penalties for getting parts of it wrong just got considerably larger.
Here’s what the law actually asks of an online retailer, in plain English.
You are a “controller”, and your tools are processors
Under the UK GDPR and the Data Protection Act 2018, you decide why and how customer data is used, which makes you the data controller. Your platform, payment gateway, fulfilment partner, email tool and analytics provider are usually processors acting on your instructions — but the buck stops with you. That’s why the contracts behind your tech stack matter, and why “the plugin handles it” isn’t a defence.
What you’re processing — and where the sensitive bits hide
Most of what you hold is ordinary customer data, but watch the edges. Health or lifestyle products can reveal special category data about a buyer. Profiling and personalisation build detailed pictures of individuals. And payment data, while not “special category” in legal terms, is exactly what attackers want — so it sits at the centre of your security obligations.
The duties that matter most
The right lawful basis. Fulfilling an order relies on contract; keeping customers secure and improving your store may rely on legitimate interests; marketing and non-essential cookies generally need consent. Using the right basis for each activity — rather than one blanket assumption — is what keeps you compliant.
Cookies and tracking (PECR). This is the online-retail flashpoint. Most analytics, advertising and personalisation tags need genuine, freely given consent before they fire — a pre-ticked box or a banner with only an “accept” button doesn’t cut it. We dig into this later in the series, because it’s where the biggest risk now sits.
Transparency. A clear, accurate privacy notice and cookie information — not a copied template — tells customers what you collect and why. It’s both a legal requirement and a trust signal at the checkout.
Security and breach planning. Online stores are a constant target. Strong access controls, keeping platforms patched, and a plan for the day customer data is exposed (you may have only 72 hours to report) are essential, not optional.
Marketing the right way. Email marketing, abandoned-cart nudges and the “soft opt-in” all have specific rules. Get them wrong and a single campaign can generate complaints — and now, far heavier fines.
Retention. You don’t need to keep customer data forever. Hold it for as long as you have a reason to, then delete it.
What the 2025 law change means for you — this one’s big
The Data (Use and Access) Act 2025 matters more to online retailers than to almost anyone. Two changes stand out. First, the maximum fine under PECR — the rules covering cookies and electronic marketing — has risen from £500,000 to the UK GDPR ceiling of £17.5 million or 4% of worldwide turnover, whichever is higher. Sloppy cookie consent and unlawful marketing are no longer cheap mistakes. Second, the rules were eased slightly for genuinely low-risk cookies, such as some analytics and functional ones — helpful, but not a free pass, and you still need to inform customers. The Act also replaced the mandatory Data Protection Officer requirement for UK organisations with a more flexible Senior Responsible Individual model.
Where to start this week
Check that your cookie banner actually obtains consent before non-essential tags fire. Make sure your marketing only goes to people you’re allowed to email. Confirm one named person knows what to do if there’s a breach. Those three steps address where online retailers are now most exposed.
dponesto helps online retailers handle data protection without hiring a full-time specialist — from fixing cookie consent and marketing compliance to acting as your outsourced data protection lead. If you’d like a plain-English review of where your store stands, get in touch.