For many small retailers, running a GDPR online shop feels like facing a bureaucracy monster – yet the core obligations are manageable once you sort them out. After a number of WooCommerce projects in Vienna and across the DACH region, I know: most small shops do not need a full legal programme, but a handful of cleanly implemented building blocks. This guide shows in practical terms what a small shop really needs, which violations are the most common and what to watch out for.
Important note: this is not legal advice. I describe the technical and practical implementation from a developer perspective. For legally binding statements – especially on your specific texts and contracts – consult a lawyer specialised in data protection.
Why GDPR affects shops in particular
An online shop naturally processes a lot of personal data: name, address, email, order history, payment data, sometimes date of birth or phone number. That is exactly why a shop is more sensitive under data protection law than a pure information website. The good news: standard systems like WooCommerce already bring a lot of this along if configured correctly. The bad news: no shop becomes compliant on its own – it takes deliberate decisions.
What a small shop really needs
Privacy policy – complete and current
The privacy policy is mandatory and must transparently list which data you process for which purpose, who it goes to (payment providers, shipping services, analytics tools) and how long it is stored. A copied template rarely does the job – it has to match your actual shop. Every tool that processes data belongs in it.
Cookie consent – but done right
A cookie banner is not a decorative element. Non-essential cookies (tracking, marketing, analytics) may only be set after active consent – not beforehand. That means: rejecting must be as easy as accepting, and without consent no analytics or marketing script may load. Many shops use banners that look pretty but load the scripts immediately anyway – one of the most common violations.
Data processing agreements with your providers
Every external service that processes personal data on your behalf – hosting, payment provider, newsletter tool, shipping service – needs a data processing agreement (DPA). Most reputable providers supply one; you just have to sign and document it. This is easily forgotten, but it is a clear obligation.
Rights of data subjects
Your customers have rights you must be able to fulfil: access to stored data, rectification, erasure, portability, objection. In practice that means: you have to know where which customer data sits and be able to answer requests within a reasonable period. WooCommerce has built-in tools to export and erase personal data for exactly this.
Payment data – outsource the responsibility
The safest way to handle payment data is not to store it yourself at all. Reputable payment providers (credit card, PayPal, Klarna and the like) process the sensitive data on their side – ideally your shop never sees credit card numbers. That massively reduces your risk. A shop that stores card data itself opens a barrel that hardly any small retailer can close safely.
The practical checklist
I work through these points on every shop project. They cover the most common obligations:
| Building block | Mandatory? | What to watch |
|---|---|---|
| Privacy policy | Yes | Tailored to the real shop, all tools named, kept current |
| Legal notice / imprint | Yes | Complete provider identification, easily reachable |
| Cookie consent | Yes (with tracking) | Scripts only after consent, rejecting as easy as accepting |
| DPA with providers | Yes | Concluded and documented for every processor |
| SSL/HTTPS | Yes | Encrypted transfer of all data, no form over HTTP |
| Data subject rights | Yes | Access and erasure technically possible, requests answered in time |
| Data minimisation | Yes | Only collect data that is actually needed |
Think about data protection from the start
The GDPR knows two principles many people skim past because they sound technical – yet they save the most work in daily operation: „privacy by design” and „privacy by default”. Translated: data protection belongs built into the shop from the start, not bolted on afterwards, and the most privacy-friendly setting is the default.
In practice that means a few concrete decisions: newsletter checkboxes are not pre-ticked by default. A guest checkout is possible without forcing an account. Optional fields really are optional. These small things add up to a shop that treats the GDPR not as a brake but as a natural part of a clean build. Think it through from the start and you save the expensive retrofitting – and this approach is exactly part of a professional implementation.
Retention and erasure: do not store forever
An often-overlooked point: personal data may not be stored indefinitely. Order and invoice data are subject to tax retention periods – so the data has to be kept for a certain time, but then deleted or anonymised. For other data – abandoned cart remnants, old accounts of inactive customers, newsletter unsubscribes – the rule is: get rid of it once the purpose is fulfilled.
In practice that means having a concept for deletion periods and implementing it, rather than keeping data „just in case” forever. A shop that hoards every order from the last five years along with all customer data, without being able to name a reason, violates the principle of storage limitation. Clarify the specific periods with your tax advisor, and for the data protection side with a lawyer.
Data transfers to third countries
A technically delicate point: many popular tools – analytics, marketing, sometimes even fonts or maps – transfer data to servers outside the EU. That is not automatically forbidden, but tied to conditions and a frequent flashpoint in warning letters. The pragmatic approach for a small shop: where possible, choose services that process within the EU, embed external resources locally instead of loading them from foreign servers, and for every third-party provider check where the data actually flows. Fewer external services mean a smaller attack surface – another argument for a lean, cleanly built shop.
The most common violations
From practice, the mistakes I keep meeting in existing shops:
- Tracking before consent. Google Analytics or marketing pixels load immediately on page load, even though the user has accepted nothing yet. Classic number one.
- Copied privacy policy. A text taken from another site that names tools the shop does not even use – and stays silent about others that actually run.
- Missing DPA. Newsletter tool and payment provider in use, but no data processing agreement concluded.
- Collecting too much data. Mandatory fields for phone number and date of birth that are not needed for the order at all.
- Newsletter without double opt-in. Sign-ups without a confirmation email – legally delicate and practically vulnerable.
Most of these points can be solved cleanly in WooCommerce with the right settings and extensions. How a shop is set up correctly from the ground up is something I describe in online shop development – and if you are still at the platform choice, the article create an online shop: which platform will help.
What violations can cost you
In theory the GDPR provides for high fines – up to a percentage of annual turnover or figures in the millions. In practice, the spectacular sums hit large corporations. For a small shop the more realistic risk is a different one: warning letters from competitors or associations, complaints from customers to the data protection authority, and the reputational damage when it becomes public that customer data was poorly protected. Smaller fines and legal costs add up quickly too. The effort for clean implementation is almost always lower than the cost of a violation.
Conclusion
GDPR for a small online shop is manageable once you break it into its building blocks: a privacy policy tailored to the real shop, a cookie consent that loads scripts only after consent, DPAs with all providers, fulfillable data subject rights, and payment data you are best off not storing yourself. Most of these points can be implemented technically in a cleanly set-up WooCommerce shop. The most common violations – tracking before consent, copied policies, missing contracts – are avoidable once you know them. And again: for the legally binding review of your texts, bring in a lawyer – this guide is the technical side, not legal advice.
Want to set up a shop to be GDPR-ready, or check and improve an existing one? Write to me via the contact form – I will look at your shop and implement the technical building blocks cleanly, from consent to payment integration.
