GDPR and E-commerce: A guide to achieving compliance

Data protection has become a major concern for consumers and businesses.

The General Data Protection Regulation (GDPR) imposes strict rules to ensure the confidentiality and security of personal information.

This article aims to guide e-commerce businesses in their efforts to comply with the GDPR.

What is the GDPR?

The GDPR is a regulation of the European Union designed to harmonize data protection laws across the EU, strengthen citizens' rights to privacy, and impose increased obligations on businesses regarding the processing of personal data.

To find out more about the RGPD, read our article: What is the RGPD?

Key principles of the GDPR

1. Transparency: Clearly inform users about how their data is collected and used.
2. Purpose limitation: Collect data only for specific, explicit, and legitimate purposes.
3. Data minimization: Collect only the data necessary for the declared purposes.
4. Accuracy: Keep data up to date and accurate.
5. Storage limitation: Retain personal data only for as long as necessary for the declared purposes.
6. Integrity and confidentiality: Ensure the security of data against unauthorized or unlawful processing.

Obligations of e-commerce businesses

The legislation requires taking certain measures to ensure the security of the e-commerce database.

Article 5 of the GDPR emphasizes three essential axes for this protection:

Data security

It is essential to guarantee the integrity and protection of the collected personal data while minimizing the risk of loss in case of hacking. The extent of security measures depends on the sensitivity of the data involved (name, first name, age, banking information, etc.).

To secure an e-commerce data, we invite you to start with the basics of the digital:

• Keep your antivirus up to date.
• Keep your software up to date.
• Regularly change your passwords.
• Encrypt collected data.

Although these may seem basic, data breaches often start with simple and common vulnerabilities that are often overlooked.

Data records, access, and retention periods

The company's leader is legally responsible for the company's data records. To optimize file security, it is crucial to determine which services and members of your company can access them.

This privileged access must be clearly defined and documented to ensure transparency and traceability of data consultations and uses.

Your data record should provide an overview of the processing of personal data collected within the company, including:

• The purpose of collection (customer loyalty, cart recovery, etc.)
• The categories of data collected (for example, for customer loyalty: name, first name, gender, date of birth)

➡️ Dastra offers a feature that allows you to create and collaboratively manage data processing registers.

For an e-commerce business, data retention is crucial for legal, operational, and security reasons.

Here are some examples of types of data that an e-commerce business might retain, along with typical retention periods and reasons why this data is important:

1. Transaction data:

   • Examples: Order details, purchase history, invoices.
   • Retention period: Generally 5 to 10 years.
   • Reason (or purposes): Tax and accounting compliance, dispute resolution, sales trend analysis.

2. Customer data:

   • Examples: Names, addresses, phone numbers, email addresses, interaction history.
   • Retention period: As long as the customer has an active account and for a few years after the account deactivation.
   • Reason (or purposes): Customer service, personalized marketing, customer loyalty.

3. Payment data:

   • Examples: Credit card information (typically tokenized), billing details.
   • Retention period: Usually, payment data is retained for the duration necessary to process the transaction, with tokenized or masked elements kept longer for security and tracking purposes.
   • Reason (or purposes): Payment processing, fraud prevention.

4. Site browsing and usage data:

   • Examples: IP addresses, cookies, browsing history, user preferences.
   • Retention period: 6 months to 2 years.
   • Reason (or purposes): User experience optimization, targeted marketing, site usage analysis.

5. Customer support data:

   • Examples: Chat records, support emails, support tickets.
   • Retention period: 1 to 3 years.
   • Reason (or purposes): Improvement of customer service, dispute resolution, internal training.

6. Legal compliance data:

   • Examples: Identity verification documents, user consents.
   • Retention period: Dependent on local legal requirements, often 5 to 7 years.
   • Reason (or purposes): Compliance with regulations (such as GDPR in Europe), fraud prevention.

Best practices for data retention

1. Data retention policy: Establish a clear policy describing how long each type of data is retained and why.

2. Data security: Implement robust security measures to protect stored data, including encryption, firewalls, and regular audits.

3. Regulatory compliance: Ensure compliance with local and international data protection laws, such as the GDPR, CCPA, etc.

4. Limited access: Restrict access to sensitive data only to employees who need it for their work.

5. Secure deletion: Ensure that data is securely deleted when no longer needed, using methods such as secure erasure or physical destruction of storage media.

These practices not only ensure legal compliance but also build customer trust and enhance the security of e-commerce operations.

What to do in case of data breach?

Zero risk does not exist when it comes to computer security. If your store is a victim of a malicious attack or unintentional data alteration, it is imperative to report any compromise to the CNIL (French Data Protection Authority).

This report must be made online on the CNIL website. In the event of a major incident, you must also inform the affected individuals so that they can take necessary measures.

➡️ With Dastra, easily create your incident reports! Store and manage your data breach records. Test now and improve your security!

How do I know if I am in compliance? How do I get up to date?

Wondering if your store is GDPR compliant or if adjustments are needed? Don't panic, the CNIL offers a MOOC, a distance learning program specifically designed for professionals.

This training, called 'L’atelier RGPD,' was developed by CNIL lawyers and is completely free. It consists of four essential modules to guide you in your efforts:

1. The GDPR and its key concepts
2. Principles of data protection
3. Responsibilities of the actors involved
4. The DPO and compliance tools

At the end of the MOOC, participants receive a certificate of completion, which is a valuable bonus.

What are the penalties for non-compliance?

Now that you know how to comply with the GDPR, it is important to be aware of the potential consequences in case of non-compliance:

• A reprimand
• Temporary or definitive limitation of data processing
• Suspension of data flows
• An administrative fine of up to 20 million euros
• An administrative fine of up to 4% of the company's annual global turnover

These penalties serve as a serious reminder of the importance of GDPR compliance!

Compliance with the GDPR is essential for e-commerce businesses not only to avoid severe penalties but also to gain consumer trust!