Disclaimer; I’m not a solicitor, lawyer and definitely not an expert on EU law. All suggestions and advice is given from my interpretation of the GDPR regulations in relation to eCommerce systems. It should hopefully get you thinking about areas you may not have considered.
As the GDPR deadline approaches and companies scramble to ensure they’re compliant, I’m going to take a look at a handy checklist that covers aspects of compliance that will be relevant if you’re running or own an eCommerce store. It talks about Magento but is relevant for all eCommerce store owners.
I can’t be bothered to read this, shall I just ignore GDPR?
What’s the worst that can happen?
The relevant provisions on data security are contained under Articles 5 and 32 of the Regulation. This covers how data should be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
A data controller or data processor could be sued for compensation as well as being exposed to the administrative fines – being fined will not shield it from compensation claims, and vice versa.
- €10m or 2% of global annual turnover, whichever is greater
- 30 days of business suspension
It will take a very high level of violation to achieve those levels of fines, but having clear evidence of compliance will be beneficial during any investigation.
As public knowledge and concern has grown about data privacy, a data breach or any kind of unauthorised data use; this will result in a PR nightmare for companies clearly falling short of new regulations and as with current Data Protection regulations it can potentially open you up to being sued for compensation.
Practical Checklist for eCommerce
1. Database access
Have you considered who has access to your customers’ data in your store’s database?
Is there a log of who has accessed the data?
2. Magento admin access
The Magento admin provides a full GUI for the customer’s private data, either through Customer or Sales management sections; with sales and order forms, overview grids and csv exports of the data available. If you give access to any administrators you should consider if they need it, and preferably setup correct admin groups using Magento’s flexible ACL rules to ensure all admins only have access to the data they need.
3. Consent from users
You need to ensure all of your customers’ data has been given with full consent and the customers know how the data is to be used. Having a single checkbox at the end of the checkout will no longer cut it. Be specific about each piece of data that you’re taking and ensure the consent is clear.
If you need to take the customers telephone number, ensure they’re aware of why you need it if it’s for delivery or order processing. The customer giving you their telephone number doesn’t then make it available for marketing purposes afterwards. Even if it would get great conversion rates, don’t do it!
4. Data profiling and external software
If you send customer data to external / 3rd parties then your customers should be aware of this. Go through and check what analytics software you have installed, I worked on a site recently that had 8+ external scripts capturing data that ran on every page.
Consider checking your website with https://builtwith.com as this will show you all tracking scripts installed, but it’s always good to ask an experienced web developer to check and confirm this.
5. The possibility of being forgotten
GDPR requires that customers data can be removed; if they’ve selected that they can be contacted, there must be a way for them to change their mind and update this preference. Other data you should consider;
- Are invoices and fiscal documents containing personal data deletable?
- Can all data from forms completed with private data in the past be deleted?
- Is the customer’s order history deletable?
- Can the customer remove saved payment methods?
More tips are available from the GDPR compliance checklist from Divante. For a full comprehensive checklist you can download this from Divante’s website.
Anonymising your eCommerce Data.
If you have multiple versions of your store on different servers then it’s important to remember each version of your site will contain real customer data that you’re responsible for. Likewise, if you need to send your site to outsource developers, we recommend using this module to anonymise your customer data prior to sending or when on a separate server or even developers local machines.