GDPR
GDPR requirements for an ecommerce site
Find out which GDPR obligations apply to your ecommerce site in 7 questions covering cookies, payments, marketing, and cross-border data transfers.
Last updated: 1 May 2025
Do Ecommerce site need to comply with GDPR?
Find out which GDPR obligations apply to your ecommerce site in 7 questions covering cookies, payments, marketing, and cross-border data transfers. If yes: GDPR applies — delegate payment processing immediately. If not: Cookie consent in place — confirm other GDPR obligations. Us…
- Yes path: GDPR applies — delegate payment processing immediately
- No path: Cookie consent in place — confirm other GDPR obligations
- Use the step-by-step decision tree below for your exact situation
GDPR · Question 1
Do you sell to customers located in the EU?
Selling to EU residents — even from a non-EU country — triggers GDPR for those transactions.
For informational purposes only. Consult qualified legal counsel before making compliance decisions.
Decision Criteria & Full Path Breakdown
Review all branch conditions, regulatory criteria, and outcomes assessed by this decision tree.
- 1
Do you sell to customers located in the EU?
Selling to EU residents — even from a non-EU country — triggers GDPR for those transactions.
If Yes: Proceeds to: Does your site use cookies or tracking pixels?If No: GDPR does not apply — no EU customers - 2
Does your site use cookies or tracking pixels?
Google Analytics, Meta Pixel, TikTok Pixel, Hotjar, Clarity — any script that reads or writes data in the browser.
If Yes: Proceeds to: Do you show a cookie consent banner before setting non-essential cookies?If No: GDPR applies — limited tracking, but checkout data is still in scope - 3
Do you show a cookie consent banner before setting non-essential cookies?
Non-essential cookies (analytics, advertising) require prior consent under GDPR and the ePrivacy Directive. Pre-ticked boxes don't count.
If Yes: Proceeds to: Do you send marketing emails to customers?If No: GDPR applies — cookie consent banner required immediately - 4
Do you send marketing emails to customers?
Post-purchase newsletters, promotional offers, abandoned cart emails — all require a valid legal basis.
If Yes: Proceeds to: Did customers explicitly opt in to receive marketing, or are you relying on the 'soft opt-in' exemption for existing customers?If No: Cookie consent in place — confirm other GDPR obligations - 5
Did customers explicitly opt in to receive marketing, or are you relying on the 'soft opt-in' exemption for existing customers?
Soft opt-in: you can email existing customers about similar products without fresh consent, if you gave them an easy way to opt out at the time of purchase.
If Yes: Proceeds to: Do you store payment card data or use a PCI-DSS compliant processor like Stripe or Adyen?If No: GDPR applies — fix your email marketing consent model - 6
Do you store payment card data or use a PCI-DSS compliant processor like Stripe or Adyen?
Storing raw card numbers yourself triggers PCI-DSS and significant GDPR risk. Most shops delegate this to a processor.
If Yes: Your GDPR baseline looks solid — review data transfers nextIf No: GDPR applies — delegate payment processing immediately