How to tell if your shop is GDPR compliant 📜

Do you process personal data in your online shop? Then you must comply with the General Data Protection Regulation (GDPR) . Many shops violate the GDPR – often unknowingly. This can be costly. Here you can find out how to check if your shop is legally compliant.

1. Is a privacy policy available and up-to-date?

Every online shop needs a complete privacy policy . It must explain exactly:

• What data you collect
• What you can use them for
• What rights do users have?
• How they can have their data deleted or changed

Do not use old texts or templates without checking them first. There are reputable generators like eRecht24.

2. Cookie Banner: Consent required before setting

Tracking and marketing cookies require consent . A correctly implemented cookie banner must:

• Only set technically necessary cookies in advance.
• Obtain active consent for all other cookies
• Allow revocation at any time

Tools like Cookiebot help you keep track.

3. SSL encryption is mandatory

When transferring customer data (e.g., during checkout ), you must use HTTPS . This protects against unauthorized access.

Here's how to check your certificate:

• Is a lock symbol visible in the browser?
• Is your certificate valid and up-to-date?

4. Enable data access and deletion

Your customers have the right to:

• To obtain information about stored data
• To change or delete this data

Your shop must support these functions technically and organizationally – via customer account or support request.

5. Order processing with external service providers

They use tools such as:

• Newsletter software (e.g. Mailchimp)
• Cloud services
• payment provider

Then you need a data processing agreement (DPA) with these providers. Otherwise, you risk receiving a cease-and-desist letter.

6. Legal notice and terms and conditions: complete and up-to-date

Even though it's not directly GDPR compliant: Your shop needs a legally compliant imprint and terms and conditions . They must be clear, easily accessible, and up-to-date.

7. Form fields: Only the essentials

Collect only the data you really need. Example:

• Newsletter registration: email address only
• Customer account: Limit required fields

An optional feedback field? No problem. But don't make it mandatory unless absolutely necessary.

8. Data protection information regarding tracking and analysis

Are you using Google Analytics or Meta Pixel? Then you need to:

• anonymize the IP address
• Conclude a data processing agreement
• Provide correct data protection information

Alternatives like Matomo host locally and are easier to use in compliance with GDPR.

9. Newsletter: Double Opt-In

You need verifiable consent for shipping . This means:

• Double opt-in with confirmation link
• Logging of consent
• Unsubscribe link in every email

10. Technical and organizational measures

You must ensure that your data is protected – including internally:

• Regular backups
• Strong passwords and access controls
• Firewall, antivirus programs

Have you already checked your shop?

Which tools do you use for data protection and cookie management? Write it in the comments – or ask your questions. Let's learn from each other.