UK GDPR compliance is an ongoing operational discipline, not a one-off box to tick at launch. Here's what UK online retailers need in place to handle customer data lawfully and defend themselves if the ICO ever comes asking.
The core principles underpinning UK GDPR
UK GDPR, sitting alongside the Data Protection Act 2018, is built around a small number of core principles that should guide every decision about customer data: collect only what you genuinely need (data minimisation), be transparent about what you collect and why, keep data accurate and up to date, don't keep it longer than necessary, and keep it secure. Most practical compliance questions can be answered by returning to these principles rather than memorising the full regulation.
Every UK business processing personal data of any meaningful volume must register with the Information Commissioner's Office and pay the associated data protection fee, which is tiered by turnover and staff numbers — this is a straightforward legal obligation that's frequently overlooked by newer online sellers.
Establishing a lawful basis for each use of data
You need a valid lawful basis for every purpose you use customer data for, and 'consent' is not automatically the right (or easiest) basis for everything. Processing an order, arranging delivery and handling a return are typically justified under 'contract' — you need the data to fulfil your obligations to the customer. Sending marketing emails, by contrast, generally requires explicit, opt-in consent under PECR as well as UK GDPR, except for a narrow 'soft opt-in' exception for existing customers marketing similar products.
- Contract: processing necessary to fulfil an order (address, payment details, contact information).
- Consent: marketing communications, unless the narrow PECR soft opt-in exception applies.
- Legal obligation: retaining transaction records for tax and accounting purposes.
- Legitimate interests: basic fraud prevention and website security, carefully documented and balanced against customer privacy.
Retention limits and secure disposal
Decide and document how long you keep different categories of data, and actually enforce it — customer accounts that have been dormant for years, old marketing lists nobody has emailed in a long time, and abandoned cart data are common examples of data retained well past any genuine business need, which increases your breach exposure for no benefit. HMRC generally requires financial records to be kept for six years, which sets a sensible retention period for transaction and invoice data even though other customer data may need to be deleted sooner.
Managing third-party processors and suppliers
Almost every online retailer shares data with third parties: payment processors, delivery couriers, email marketing platforms, review platforms and fulfilment warehouses. Each of these is a 'data processor' acting on your instructions, and UK GDPR requires a written data processing agreement (DPA) in place with each one, setting out what they can and can't do with the data and their security obligations.
Most reputable UK and international SaaS providers offer a standard DPA you can accept as part of signing up — read it rather than skipping past it, and pay particular attention to whether the provider transfers data outside the UK/EU, which triggers additional international transfer safeguards under UK GDPR.
Marketing consent and preference management
Give customers a clear, granular way to manage their marketing preferences — separate consent for email, SMS and any postal marketing, rather than a single all-or-nothing toggle — and make unsubscribing at least as easy as subscribing was. Keep a clear record of when and how consent was given for every marketing subscriber, since the burden of proving valid consent sits with you, not the customer, if it's ever challenged.
Training staff and building ongoing accountability
Compliance ultimately depends on the people handling data day to day, not just the policies on your website. Give staff who handle customer data — customer service, marketing, fulfilment — basic training on what they can and can't do with it, how to recognise a subject access request, and who to escalate a suspected data incident to. Appoint a named individual (it doesn't need to be a full Data Protection Officer for most small online retailers) with clear accountability for data protection, so compliance questions have an owner rather than falling through the cracks between departments.
Bringing It Together
As with most things covered in Risk, Security & Compliance, UK GDPR and data protection compliance: a practical guide for online retailers works best when it's revisited periodically rather than decided once and forgotten. This connects directly with Handling Subject Access Requests and Statutory Data Breach Notifications Under UK GDPR, which walks through the practical detail.
It's also worth thinking about Legal & Consumer Rights from your customers' perspective, not just your own liability. Transparent, clearly communicated policies build trust and reduce disputes before they start, while opaque or overly restrictive terms — even where technically compliant — tend to generate more complaints, chargebacks and reputational damage than they prevent.
For related reading: It's worth reading this alongside Building a Data Breach Incident Response Plan for UK Online Retailers before making a final decision. Our companion guide, Structured Data and Schema Markup for Product Pages: A Practical Implementation Guide, goes into this in more depth.