Key takeaways
- The GDPR obliges you to handle customer data with care.
- Provide a privacy statement, a secure (SSL) webshop and clear consent.
- Only collect data that you really need.
- Good agreements with your platform and tools are part of this.
As soon as you have a webshop, you process personal data: a name, an address, an e-mail address. This means you fall under the privacy law, the GDPR. That sounds scary, but the basics are clearer than you think — it boils down to: be clear about what data you collect, handle it carefully, and give people control. This guide calmly explains what you need to arrange as a small webshop.
> This is general explanation, not legal advice. For your specific situation, consult with a specialist or the Dutch Data Protection Authority.
What data do you actually collect?
More than you think, and that's normal. For an order you usually need: name, delivery and billing address, e-mail address, telephone number and payment details (which usually go through your payment service). In addition, you sometimes collect data through your newsletter or through visitor data to your site. The GDPR asks you to deal with this consciously and neatly.
The privacy statement: your most important document
The most important thing you should have is a privacy statement on your site. In it you explain in understandable language:
- what data you collect;
- what you use them for (processing an order, sending a newsletter);
- how long you keep them;
- who you share them with (such as your payment service and delivery person);
- what rights the customer has and how to contact us.
Write it in plain words, not in legal jargon. You can use a reliable model, provided you adapt it to what you really do. Place the statement on a permanent page, linked in your footer — just like your terms and conditions, but as a separate document.
Collect only what you need
A core rule of the GDPR: do not ask for more data than you really need. You need an address to place an order; you don't have to ask for a date of birth “just to be sure”. Collecting less means less risk and more trust.
Consent for your newsletter
If you want to send someone a newsletter or offers, you need permission — someone must actively register. Never buy address lists or add people without asking. Also ensure that you can unsubscribe with one click. You can read how to build a list neatly and with permission in build an email list.
Cookies and your website
If your site uses cookies or measuring instruments that track visitors (for example for statistics or advertisements), you must show a cookie notification and, in many cases, ask permission for this. This is not necessary for purely necessary cookies (that make your site work). Keep it neat and honest: explain what you measure and why.
Secure the data
You are obliged to handle data with care. In practice:
- make sure your webshop runs on a secure connection (the lock in the address bar) — on a modern platform this is automatically enabled;
- keep data safe and only give yourself (and those who really need it) access;
- work with reliable parties for payment and shipping, who also comply with the rules.
Your customer's rights
Customers have rights under the GDPR: they can ask what data you have about them, have it corrected, or have it deleted. Make it easy to contact us (an email address in your privacy statement is enough) and respond politely and on time — that's part of good customer service. Do not store data longer than necessary.
Common mistakes
- Not having a privacy statement on your site.
- Collecting more data than you need.
- Add people to your newsletter without asking or buy lists.
- Do not show a cookie notification while you are following visitors.
- Keeping data unsafe or for too long.
Frequently asked questions
Does the GDPR also apply to my small webshop?
Yes. As soon as you process personal data — and you do this with every order — the GDPR applies, regardless of your size. The basics are doable.
What is a privacy statement?
A document on your site that explains in plain language what data you collect, for what purpose, how long you keep it, who you share it with and what rights the customer has. It is your most important privacy document.
Can I just send customers a newsletter?
No. You need permission for this: people must actively register, and unsubscribe must be possible with one click. Never buy address lists.
Do I need a cookie notification?
If your site tracks visitors (for statistics or advertisements), yes. Not for purely necessary cookies that make your site work.
How long can I keep data?
No longer than necessary for the purpose. There is a legal retention obligation for your administration; for other data, keep it for as short a time as is reasonable.
Get started
Put a clear privacy statement on your site (a model that you adapt to what you really do), collect only the data you need, and ask permission for your newsletter. Ensure a secure connection and a cookie notification if you follow visitors. Combine this with your terms and conditions. If you start at the beginning, go through the step-by-step plan to start an online store.
