The GDPR and You, the WooCommerce Store Owner

Written by Allen Snook on May 15, 2018 Blog, Getting ready for the GDPR.

Whether you’ve had a WooCommerce store for a long time or are in the earliest stages of an eCommerce endeavor, you’re probably  wondering what you need to do about this new European law—the General Data Protection Regulation (GDPR).

Our six-part series on Getting Ready for the GDPR explores the ins and outs of the law and how it applies to you, a WooCommerce store owner. Let’s get oriented with a few common questions and answers.

What is the GDPR, exactly?

The GDPR is a new law that concerns itself with the handling of personal data of European Union (EU) residents. It takes effect on May 25, 2018.

Over two years in the making, the GDPR is intended to give EU residents more visibility and control over their personal data: how websites, including eCommerce websites, collect data; who they share it with; and what tracking technologies monitor them across the Internet.

If you sell to EU residents, this law applies to you — even if you aren’t in the EU. Fines for non-compliance will be substantial and can be levied on businesses both in and outside the EU.

What new privacy-related rights does the GDPR gives EU residents?

The new law requires stores to inform their customers about what information they collect, store, and share, and establishes specific rules about the kind of consent required before stores can collect personal data. That means that stores will be asking for consent more explicitly, and detailing their use of personal data more specifically in their privacy policies.

In addition to clearer notices and privacy policies, the GDPR also gives EU residents powerful new rights such as the Right of Access, Right to Rectification, and Right to Erasure.

That means that EU residents will be able to:

  • Demand a copy of all the data you have about them.
  • Demand any errors in the data be corrected.
  • Request the removal of all personal data.  

The GDPR also gives EU residents the right to find out if their personal data has been compromised. Stores will need to notify customers if their personal data is stolen in a breach, and do so in a timely manner.

What’s Personal Data, Exactly?

GDPR isn’t about all information—the new rights for EU residents specifically apply to Personal Data.

Personal Data means anything that can identify a person, either on its own or combined with other data. Examples include a person’s:

  • Name
  • Physical address or email address
  • Phone number
  • Last four credit card digits
  • Shipping tracking numbers ( these are unique to an order, and thus to a person)
  • IP address

Basically, if you can use a piece of data to identify an EU resident, or combine it with other data to identify them—that’s personal data.

What Should I Be Doing Right Now?

We’ll unpack this over the remainder of this series, which will cover:

  • Why you need to put someone in charge of privacy. You’ll want to designate someone to lead this effort. Iif you’re a one-person shop, that’ll be you.
  • What constitutes a GDPR-acceptable Privacy Policy. You need to disclose how and why you collect personal data, how long it is retained, and who it is shared with. With WordPress and WooCommerce, you also need to consider how plugins and services your store uses affect customer privacy.
  • How to respond to Right of Access and Right to Erasure requests. There are some helpful new personal data export tools coming to WordPress and WooCommerce.
  • What to do in case of a security breach. No one wants this to happen, but preparing for this worst case scenario is part of your privacy responsibility under the GDPR.

The GDPR will be a fair bit of work for most online merchants, but this Getting Ready for the GDPR series will help you navigate this new way of handling personal data efficiently and effectively.

WooCommerce and the GDPR - get resources and tools

14 Responses

  1. Luke
    May 15, 2018 at 3:44 pm #

    Hi, GDPR is all everyone is talking about at the moment, and I am, unfortunately based in the UK, so it definitely affects me and my clients.

    It’s great news about the the data export tools that are coming to WordPress and WooCommerce, but the deadline of the 25th May is looming, are they going to be out in time? 😬

    Looking forward to anything that makes GDPR easier though 🙂

    • Gareth Allison
      May 15, 2018 at 4:25 pm #

      Hey Luke, thanks for reading.

      WooCommerce 3.4 is scheduled for 23 May 2018, so will be out before GDPR takes effect. Check out this post on our developer blog for more details.

  2. Kostas Nicolacopoulos
    May 15, 2018 at 9:38 pm #

    In the article you mention:
    > If you sell to EU residents, this law applies to you — even if you aren’t in the EU.

    Correct me if I’m wrong, but the law still applies to you, even if your shop doesn’t sell to EU residents

    Even if EU residents can’t buy from your store, their personal information will be collected if they:

    – Visit your site (their IP address is logged by analytics software and trackers)
    – Send you a message using a contact form (their name and email address is kept in the database)
    – Write a comment (name, e-mail and IP address is stored in the database)
    – Subscribe to your newsletter (e-mail address is sent to your email service provider)

    In other words even if your store or site doesn’t target EU residents, you will still need to comply with GDPR.

    Looking forward to reading the rest of the posts in the series.

    • Marina Pape
      May 16, 2018 at 12:12 pm #

      Yep, correct! Even if an EU resident doesn’t transact, a site can still be collecting personal data in various ways. Thanks for stating that so clearly 🙂

    • Ben Greenwood
      May 16, 2018 at 2:52 pm #

      Surely as you don’t operate as a business in the EU and you are based outside the EU you aren’t required to comply with EU law and you aren’t responsible for what EU residents do.

      I’m FAIRLY sure GDPR only applies to businesses based or operating in the EU. So as long as you do neither, even if you inadvertently collect EU personal data, you aren’t required to comply.

      Or am I wrong?

      • Ilse
        May 16, 2018 at 3:33 pm #

        You are wrong. Sorry. GDPR has a very long arm. Will they find a small website or business – not sure, but are you willing to take the chance of having your site/business shut down? While GDPR is complicated and a thorough pain in the butt, it’s not that hard to comply. Using services that comply is a big step in the right direction.

      • vrdesigns
        May 16, 2018 at 5:07 pm #

        “I’m FAIRLY sure GDPR only applies to businesses based or operating in the EU.”

        Unfortunately GDPR applies to personal data that belongs to EU citizens.

        Who gathers this data, and where they are based is irrelevant. It affects businesses, government and even meals on wheels voluntary services.

        Anyone who has/uses some personal data on an EU citizen must comply with the GDPR.

      • Nina
        May 18, 2018 at 6:26 pm #

        I live in The Netherlands and have 2 companies. This is how I understand it, if you have a company outside the EU and you don’t have anything to do with citizens from the EU, meaning you don’t have a marketing plan that includes citizens from the EU, or something like that. And I stumble upon your website because i’m browsing the web this does not apply to you.

        This website explains it well I think

  3. Chris
    May 17, 2018 at 9:56 pm #

    What I don’t understand is how the EU is able to prosecute business based in countries in which it has no jurisdiction? Surely national governments must protect their citizens and businesses from being prosecuted by another country, or in this case, organisation? The EU is not in charge of the internet and I think the world needs to tell it that.

    • Adrian
      May 18, 2018 at 3:00 am #

      Then maybe you should move your business to a country that has no economic relations/partnerships with the EU. Otherwise if you want to do business in the international environment, you abide by the rules.

      • David
        May 18, 2018 at 6:40 pm #

        You haven’t answered his question. How, specifically, does the EU prosecute non-EU citizens in other countries for not complying with EU law?

        • Adrian
          May 19, 2018 at 11:10 pm #

          EU has different partnerships and accords with US and other individual states or world organizations. Through those partnerships it can reach companies and organizations that are out of it’s teritorial jurisdiction.

    • David
      May 18, 2018 at 6:45 pm #

      I’d like to know this too.

  4. patnaharanand
    May 18, 2018 at 5:43 pm #

    When someone cheating how you can solved such problems

Leave a Reply

WooCommerce - the most customizable eCommerce platform for building your online business.

  • 30 day money back guarantee
  • Support teams across the world
  • Safe & Secure online payment