GDPR E-commerce Checklist – The Complete Guide

Why the GDPR was introduced…

On 24 October 1995, the European Union (EU) adopted the Data Protection Directive (officially Directive 95/46/EC). This directive was created to regulate the processing of personal data within the EU.

However, thanks to the increasing number of internet users everyday, we are now generating more data than ever before. The traditional rules for protection and privacy of personal data were non-binding. Although the directive guidelines are still true to this day, they are not enforceable by law. And these rules failed to address how that data is stored, collected, and used in the new digital world.? There were no clear guidelines that helped protect users from misuse of their private data.?

?All of this changed in May 2018, when the GDPR came into existence. This article aims to help ecommerce business owners understand what should be done to ensure GDPR compliance.

What is GDPR?

The General Data Protection Regulation (GDPR) is a legal framework. It was designed to protect personal data and privacy of users. On 25 May 2018, the EU parliament put into effect a set of rules in the form of a GDPR compliance policy.

Many regions outside the EU too have adapted and used the GDPR as a basis or reference point, while coming up with their own data and privacy related policies.

What data is covered by GDPR?

The GDPR regulation places equal gravitas on all forms of personal data. Broadly, personal data is information that is related to an identified or identifiable individual. This information includes but is not limited to, personal data relating to name, date of birth, credit card details, bank transactions, social media, and even photos. If your website uses cookies or IP addresses, that too can be construed as information that helps identify an individual.

Who does GDPR apply to?

The GDPR applies to all businesses that offer services or goods to EU citizens. This would include any e-commerce company that uses the personal data of users residing in the EU. Databases comprising?user information like bank credentials and transaction-related data fall under the GDPR.?

What if the GDPR is violated?

If you violate the regulations of GDPR, the consequences include:

• Economic Consequences:?Fines leading up to 20 million euros or 4% of the global turnover, whichever is higher. If personal data of an individual is compromised in a data breach, companies have to pay a fine.

• Reputational Consequences: Companies that are unable to prove their compliance with the GDPR regulation. This could tarnish their reputation and incur financial impositions.?

• Commercial Consequences: Data breaches have become a growing cause for concern among many customers. Especially in the e-commerce sector where customers entrust companies with sensitive personal data. 3 million Yahoo user accounts were hacked in 2013, leaving them open to data theft.?

Noncompliance with the GDPR regulation can lead to heavy financial losses.

To avoid this, the GDPR policy has established a checklist for companies to follow. The checklist below also provides key questions for organizations to confirm compliance.

The following GDPR checklist intends to create awareness about GDPR for e-commerce businesses. It is by no means to be perceived as legal advice. It aims to help e-commerce business owners gain knowledge about GDPR regulations. This guide will also help identify cardinal issues and address them.

GDPR Compliance checklist

#1. If your e-commerce business is based outside of the EU, are you complying with GDPR?

According to the European data protection law, personal data can be shared with only certain third countries. These countries must maintain an adequate level of data protection. All e-commerce companies must comply with this regulation regardless of their location.

As an e-commerce company operating outside of the EU, your business must protect the data being fed to you. This can be achieved by adhering to the GDPR e-commerce compliance policy. E-commerce companies in the United States must adhere to the Privacy Shield.

Key Questions:

• Is your company familiar with the new requirements under GDPR?

• Is your company in compliance or is remedial work required?

• Is your company Privacy Shield compliant?

• Does your company include GDPR compliance in contracts with the EU partners?

• Is your company aware of all international transfer of data?

• Is your company aware of data usage as stated in the privacy notices?

#2. Is your e-commerce business’ privacy notice in plain English?

A privacy notice is a public document. It describes how your e-commerce company applies the principles of data protection. According to the GDPR e-commerce compliance, the company must draft a privacy policy. The privacy policy must be concise, transparent, and unequivocal. It should be drafted in plain English.

Key Questions:

• Has your company updated the privacy policy for 2018 compliance on all online forums? (This would include websites, web apps as well as on any form of printed literature)

• Is your company’s privacy notice:Written in plain EnglishConcise?Clear and transparent description of how the data is being usedClear about who the data is shared with and what the user’s rights are.?

• Does your company’s privacy policy have a legal basis for processing user data if it is not based on content??

• Does your company’s privacy notice list what and how the data is being used?
• Does your privacy notice provide options for:ConsentIndividual rightsSubject Access Requests

#3. Does your e-commerce business deal with children? If yes, have you written privacy notice in a language they can understand?

The UN Convention on the Rights of the Child defines a child as anyone under the age of 18. The privacy notice should be written in a language that children will understand. Transparency of data usage is especially important when children are concerned.

Key Questions:

• As an e-commerce company, are you aware if you collect information from or about children?Is the documentation in place for the processes you use to protect information about children?Has your company documented data minimization, storage, and deletion processes for children’s’ data?Do children provide their information directly on your e-commerce website? If so, have you written a privacy notice for children in plain English language?Does your company have documentation of evidence to show that you have parental consent for processing children’s’ data?Does your company delete children’s’ data records on request from a parent or guardian? Is this done without requiring documentary evidence of the relationship?Does your company agree to requests to delete data obtained from an individual as a child, but is now an adult?

#4. Do you take consent from your visitors and customers before collecting data?

In the e-commerce domain, the GDPR aims to give customers complete control over the usage of data. Consent is one of the important elements in the data protection module.

As an e-commerce company, you must have legitimate solutions for consent management. The privacy notice on your website must include all necessary details. This would include the collection, processing, storage and usage of customer data. Additionally, the collection of data via forms, sign-ups, email collections and popups is a part of the same compliance. It should allow users to permit or withdraw their consent from the use of that data.?

Key Questions:

• As an e-commerce company, have you classified the different aspects of your data collection and processing? If yes, are?they grounded in consent or a legal basis?Do your company’s consent processes meet all the necessary criteria of the e-commerce GDPR policy?Can you produce documentation that proves that the data collection and processing is grounded on a legal basis?Is your company able to document proof of consent or legal basis for the data you collect and process?Has your company reviewed existing consent mechanisms? Can you ensure that your consent processes meet the above criteria?Does your company regularly update its consent mechanisms?Is your company prepared to stop data processing and delete records?? Even in cases where there is no legal basis or secure consent for the data collected??

#5. Have you told your users what you’re going to do with their data?

This is the most fundamental step towards the e-commerce GDPR compliance policy. E-commerce companies must be clear in their description of data retention processes. These processes include the categories of data, timelines, and verification of deleted data. Companies must describe the security measures taken to protect that data.?

The GDPR has established 8 rights for individuals under the Data Protection Act:

• The right to be informed

• The right of access

• The right to rectification

• The right to erasure

• The right to restrict processing

• The right to data portability

• The right to object

• Rights related to automated decision making and profiling

Key Questions:

• Has your company reviewed current provisions for meeting individual rights?Has your company reviewed the publicizing of individual rights in privacy notices?Has your company identified what data could be subject to these rights?Does your company own the technical capabilities to produce an electronic copy of the data you hold on a user?Does your product or service have the technical potential to facilitate data portability?Has your company allocated individual rights over data used for automated decision making? What about processing from the data that is requisite for the provision of services by your company?Is your company aware that customers cannot be charged an administrative fee? (for invoking their rights or for meeting with the company)

#6. Can your customers access a copy of the data that you have collected?

Under the e-commerce GDPR compliance policy, customers have enhanced rights over their data. Customers can make a Subject Access Request (SAR). This is done to invoke their right of access to their personal data.?

Your company’s website should clearly explain how a user can put in a SAR in the privacy notice. Your company should comply with this request and respond to it within a period of 30 days. This request is an individual’s fundamental right, hence it cannot be charged.?

Key Questions:

• Has your company created a process for users to request the SAR?Is your SAR process described and explained clearly in your privacy notices?Is your company’s internal SAR process documented? Is it approved by the data protection regulator?Does your company have a central point of contact for handling SARs?How are SARs tallied in your company? Who regulates the reception, processing, and completion of SARs in your company?Does your company have the operational strength to respond to SARs within 30 days?Does your company have systems that can generate the data required under a SAR?Does your company ensure processing of a SAR will be done?without overlooking any uses of data?

#7. Are you auditing all the data you’re collecting and processing?

An e-commerce company must inspect and audit all the data that is collected and processed. This includes both online and offline data. An e-commerce business is dependent on customer data. Therefore, the company must ensure that the data is audited and reviewed.?

Key Questions:

• Has your company audited all online information?
• Has your company audited all offline information?
• Has your company conducted an audit of how information is retained, re-used, and shared?
• Has your company audited data collected and stored from third party companies?
• Has your company reviewed partners and third party suppliers?
• Has your company maintained an inventory for the data shared with third-party companies?

Have you reviewed your application for best Privacy by Design practice?

Under the e-commerce, GDPR regulation designers and developers should ensure data protection. Starting from the design stage, all websites, apps, and business processes must adhere to ‘Privacy by Design’.?

Key Questions:

• Has your company reviewed current points of data input minimization? For instance, “required” form fields and outdated information.
• Has your company developed data retention and deletion policies? Does it include all kinds of relevant information that is stored?
• Has your company reviewed the Privacy Impact Assessments? (This is for partners and third-party service providers)
• Has your company reviewed the verification process for deleted data?
• Is your Privacy by Design process shareable with the general public?
• Would your company’s Privacy by Design process be approved by a regulator?

#9. Have you spread awareness about privacy with employees and other stakeholders?

This is one of the most basic steps involved in the e-commerce GDPR privacy policy. It is important to be aware of the various elements of the GDPR regulation and its impacts on your business. Companies must create a plan to educate employees about the GDPR regulation.

Key Questions:

• Does your company understand how GDPR is applied? Are you aware of how it is continued from the old Data Protection Act?
• Is your company compliant with the existing Data Protection Act?
• Has your company established a plan for GDPR awareness? Do you have an implementation plan for employees of all levels??
• Is your company board kept informed with regular updates about your GDPR implementation?
• Has your company allocated adequate resources to the GDPR implementation plan?
• Has your company discussed the GDPR plan implemented by your contractors and suppliers??????

#10. Do you have a Data Protection Officer?

The GDPR regulation requires that every enterprise appoint a Data Protection Officer (DPO). The DPO oversees the company’s data protection strategy and implementation. The DPO handles all matters relating to data usage, security, and protection. The DPO is in charge of training and educating company employees. The DPO conducts audits to ensure data privacy and tackle potential breach issues if any.?

Key Questions:

• Has your company determined whether appointing a Data Protection Officer is enforceable by law?
• Is your company aware of the qualifications for appointing a Data Protection Officer?
• Has the company chosen a Data Protection Officer who is available in-premise?
• Does your company maintain a list of requirements to hire a Data Protection Officer?
• Is your company prepared to allow the Data Protection Officer to become a board member of the company, if applicable?

#11. Do you have a plan ready in case of a data breach?

Data breaches are a call for concern, especially for e-commerce enterprises. The GDPR requires all companies to report certain data breaches to a supervisory authority. This process must be carried out within 72 hours of gaining awareness of the breach. If the nature of the breach is likely to affect the individual’s rights, they must be informed. Also, every company must keep a record of the data breach, regardless of its nature.?

Key Questions:

• Does your company audit systems and processes to avert potential data breach issues?
• Is your company aware of the criteria for a “high-risk”, reportable breach?
• Has your company created a template for GDPR’s data breach reporting requirements?
• Does your company conduct a postmortem of data breaches incurred in the past?
• Does your company have an internal reporting system in place to report potential data breaches?
• Is there a provision for staff who wish to report a potential issue of a data breach, either technical or human, without fear of retribution?

Conclusion

If you run an e-commerce company, this guide will help you in understanding what GDPR means for e-commerce businesses and their impact.?

The GDPR regulation enables companies and customers to protect their personal data. It is a significant improvement from the older Data Protection Act. The GDPR is quite new and not completely understood by everyone. This guide will help you plan and implement a strategy for the e-commerce GDPR compliance policy.