On 25 May the GDPR, the EU’s General Data Protection Regulation, comes into force. Until a few months ago, most online store owners I talked to in the market just shrugged: “that’s for banks and big corporations.” Now, three months out, the panic has arrived, along with all sorts of myths. It is neither the apocalypse nor a passing fad. It is a new set of rules, and it applies to the two-person shop selling tea from Brașov as well.
I also studied law for a while, and for several years now I have been building marketing automation tools for online stores at Retargeting. That is exactly the kind of software that runs on personal data. So I see the problem from both sides: what the law asks for, and what it means in practice inside a store. Below is my practical checklist. This is not legal advice. It is a starting point, so you know what to ask a specialised lawyer before May, not after.
1. Map your data: what you collect, where from and why
The first step is boring and the most important. Take a sheet of paper (or a spreadsheet) and list every place personal data enters your store: customer accounts, the checkout form, the newsletter, the live chat, the contact form, reviews, analytics and advertising cookies, the exports you send to your courier. For each one, write down what data it is, why you need it, who has access, where it is stored and how long you keep it.
You will find some funny things. Say you run a pet supplies store: you probably ask for the customer’s date of birth even though you never use it. The GDPR has a simple principle: collect only what you need. If you don’t use it, stop asking for it.
2. Legal basis: not everything has to be consent
One of the biggest misunderstandings is that you need the customer’s consent for everything. You don’t. The regulation lists several legal bases, and for an online store three or four matter most:
- Performance of a contract: to deliver an order you need a name, an address and a phone number. No tick box needed, it is obvious.
- Legal obligation: invoices must be kept as tax law requires, whether the customer likes it or not.
- Legitimate interest: fraud prevention, site security, sometimes certain messages to existing customers. Here you have to weigh honestly whether your interest overrides the customer’s rights, and document your reasoning.
- Consent: for newsletters to people who are not customers, for most marketing cookies, for more aggressive profiling.
For every line in your data map, write down the legal basis. If you cannot find one, you probably should not be collecting that data.
3. The newsletter: no pre-ticked boxes
This is where marketing changes the most. Consent must be freely given, specific, informed and unambiguous. In plain English: the sign-up box is unticked by default, it is separate from accepting the terms, and it says clearly what people will get and how often. Unsubscribing must be as easy as subscribing. And you must be able to prove when and how someone agreed, so keep the date, the source and the wording of the form.
The real problem is old lists. If you have collected addresses over the years without clear consent, or no longer know where they came from, consider a re-permission campaign before May: a simple email asking subscribers to confirm they want to stay. You will lose part of the list. It hurts, but a smaller, engaged list usually sells better than a big dead one. I wrote a while ago about why email marketing still drives sales, and the argument still holds: with people who actually want to hear from you.
4. A privacy policy people can actually read
Most privacy policies on Romanian online stores are copied from someone else and nobody has read them, not even the person who published them. The GDPR asks for clear information in plain language: who you are, what data you collect, why, on what legal basis, who you share it with, how long you keep it, what rights people have and how they can reach you. If you use providers outside the European Union, say so. Write it as if you were explaining it to a customer on the phone, then have a lawyer review it.
5. Cookies and the providers you work with
Cookie rules come mainly from the ePrivacy Directive, transposed into Romanian law years ago, and Brussels is working on a new regulation on the topic. What is already clear: a banner saying “this site uses cookies” with no choice at all is getting harder to defend for advertising and profiling cookies. Make an inventory of the scripts on your site (analytics, ad pixels, chat, recommendations) and explain them on a dedicated page.
Then, your providers. The courier, the email platform, the payment processor, hosting, web analytics, your remarketing platform: they all process data on your behalf or alongside you. With those acting as processors you need a data processing agreement (DPA). Many big providers already have a standard one; ask for it and file it. From the other side of the table, I can tell you that we, as a software provider, are preparing in the same way. If you use automations such as abandoned cart emails, ask your provider which legal basis it recommends and where the data is stored.
6. Customer rights: access, deletion, portability
Customers have the right to know what data you hold about them, to correct it, to ask for it to be erased under certain conditions, to object to direct marketing and to take their data with them. As a rule you have one month to respond. You don’t need a sophisticated system, just a process: a dedicated email address, a person in charge and a list of every place the data has to be removed from (the store, the email platform, the CRM, the spreadsheets). Careful: “erasure” does not mean deleting the invoices tax law requires you to keep.
7. Security, breaches and how long you keep data
Security is not only for banks. The decent minimum: HTTPS across the whole site, strong and unique admin passwords, two-factor authentication where possible, up-to-date platform and plugins, role-based access (not everyone needs to export the full customer list) and backups. And stop emailing customer lists around.
If you suffer a security breach that may affect people, you must notify the supervisory authority (in Romania, ANSPDCP, the national data protection authority) within 72 hours of becoming aware of it, and in serious cases the affected individuals too. 72 hours go by fast, so write a one-page plan in advance: who decides, whom you call, what you say.
On top of that, set retention periods. Accounts inactive for five years, addresses from an old contest: why are you still keeping them? Set a rule and apply it.
8. Do you need a DPO?
A Data Protection Officer is mandatory for public authorities and for companies whose core activities involve regular and systematic monitoring of people on a large scale, or large-scale processing of sensitive data. Most small stores do not fall into this category. But “usually not” does not mean “never”: if customer profiling really is the heart of your business, or you sell products from which health data can be inferred, check with a lawyer.
Fines and the right perspective
Yes, maximum fines go up to 20 million euros or 4% of global annual turnover, whichever is higher. Nobody knows yet exactly how the authorities will enforce the regulation in the first years, and Romania’s national implementing law is still being drafted. Don’t look at the GDPR only as a threat. It is also a chance to clean house: cleaner lists, less useless data, customers who trust you. Anyone doing marketing automation honestly, with people’s consent, has little to fear.
How are you getting ready for 25 May? Have you already started, or are you waiting to see what everyone else does?