The General Data Protection Regulation (Regulation (EU) 2016/679) has applied since 25 May 2018. It covers any organisation that handles personal data of people in the EU, including businesses outside the EU that sell to them or track their behaviour.
What counts as personal data
Any information about an identified or identifiable person: names, email addresses, phone numbers, IP addresses, cookie identifiers, location data, order history. Some data is "special category" (health, religion, biometrics, sexual orientation, political opinions) and needs extra protection under Article 9.
The seven principles (Article 5)
- Lawfulness, fairness and transparency: a legal basis for every use, explained clearly.
- Purpose limitation: collect for specific purposes and do not reuse data for unrelated ones.
- Data minimisation: only what you need.
- Accuracy: keep it correct and up to date.
- Storage limitation: delete or anonymise it when you no longer need it.
- Integrity and confidentiality: protect it with appropriate security.
- Accountability: be able to prove you comply.
The six legal bases (Article 6)
Every processing activity needs one: consent, performance of a contract, a legal obligation, vital interests, a public task, or legitimate interests. Consent must be freely given, specific, informed and unambiguous, and as easy to withdraw as to give (Articles 4(11) and 7). For an online shop, the order itself is usually "contract"; analytics and advertising trackers usually need consent (see Cookies & Consent).
Documents you need
- Records of processing activities (Article 30): what data, why, who receives it, how long you keep it.
- A privacy notice (Articles 12 to 14): see Privacy Policy.
- Data processing agreements (Article 28) with every processor: see Third-Party Services.
- A data protection impact assessment (Article 35) before high-risk processing, such as large-scale profiling or monitoring.
- A breach log (Article 33(5)), even for breaches you did not have to report.
Do you need a data protection officer?
Under Article 37, yes if you are a public body, or if your core activities involve large-scale regular and systematic monitoring of people, or large-scale processing of special category data. Many small online businesses do not, but naming someone responsible for data protection is still good practice.
Breaches
A personal data breach must be reported to your supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people (Article 33). If the risk to people is high, you must also tell them without undue delay (Article 34). Our story on the Odoo Cloud breach email shows what to check when a provider is breached.
Up to 20 million euros or 4% of worldwide annual turnover for breaches of the principles, legal bases or data subject rights; up to 10 million euros or 2% for other obligations such as records and security (Article 83).
This guide is general information about EU rules, not legal advice. Requirements can differ by country and by business: check with your data protection authority or a lawyer for your case.