How to Handle Personal Data as an E-Commerce Business in England and Wales

As an e-commerce business, you must handle your customers’ personal data securely. This is the case even if you only work with a few clients. Indeed, after the General Data Protection Regulations (GDPR) came into effect in 2018, businesses in England and Wales faced greater restrictions to protect the information they collect from their customers. Under the GDPR, you can face fines of up to £17.5 million if you mishandle personal information. Therefore, you need to ensure you are correctly handling and storing personal data. This article will provide several tips on how your e-commerce business should handle personal data and stay GDPR compliant. 

What is GDPR Compliance?

The main role of GDPR is to impose greater restrictions on businesses to better safeguard how they use and collect personal data. Indeed, as an e-commerce business, you will find yourself collecting and acquiring a range of information about your customers in the day-to-day operations of your business. This is known as processing data. 

You must ensure you handle your customers’ information correctly, from home addresses to bank details, to ensure you do not breach GDPR. There are several ways to ensure you are handling personal information correctly.

Register with the Information Commissioner’s Office

The Information Commissioner’s Office (ICO) is responsible for policing data protection regulation in England and Wales. Any organisation that holds or processes personal data must register with the ICO and pay a data protection fee each year. If you are unsure whether you should register with the ICO, you can take their self-assessment questionnaire. By doing this questionnaire, you should be able to determine whether you need to register with the regulator. 

Generally, as an e-commerce business, you will need to register with the ICO if your business collects and uses customer names and shipping addresses. Additionally, collecting customer email addresses and phone numbers will require registration. Moreover, you will need ICO registration if you collect payment details and banking information. Finally, if you collect location data or cookies, you will need to register with the ICO.

Additionally, while many businesses question the need to be registered with the ICO, being registered is a great way for your business to show that you are a reputable organisation that adequately safeguards its customers’ personal information. 

Create a Privacy Policy

The next step in handling personal data properly is to create a privacy policy that discloses how you intend to use that information to your customers. Under the GDPR, individuals have rights that your business must respect. Those rights include rights to: 

• have their personal data erased; 
• know what you intend to do with their data; and 
• have their data safely stored.

While businesses are not legally required to have a privacy policy, it is advisable that your e-commerce business has one in place. A privacy policy ensures you correctly disclose how you intend to use and process personal information to members of the public. Therefore, it is wise to draw up a privacy policy to inform your customers: 

• why you are collecting and processing their data;
• how you are legally allowed to hold and use their data; 
• the length of time for which you intend to store their information; 
• how they can get in touch with you to delete, access or correct that information; and
• their rights to make a complaint to the ICO if your business is wrongfully using their information. 

Update Your Cybersecurity Practices 

Additionally, as an e-commerce business, you must ensure that you store personal information in a secure, encrypted location. Many data breaches occur when businesses do not take appropriate steps to store their information in safe environments. Therefore, it is vital to store personal information on a backed-up location that is password protected. 

To ensure your storage systems are as secure as possible, you may want to consider doing the following: 

• regularly change the passwords to access that data; 
• only give those passwords to trusted employees;
• enable two-factor authentication on your storage devices and programs;
• ensure you have the latest antivirus software installed on all devices;
• do not ignore software updates for your computers; and
• secure your personal information in a device not connected to the internet. 

Employee Education

Educating your employees on handling personal information is one of the most important ways to help you protect your customer’s data. Your employees are regularly working with personal information. Because of this, they pose some of the biggest data privacy risks that can open your e-commerce business up to various lawsuits if a breach occurs. Fortunately, providing employees with regular training on handling and using customer information can reduce the risk of a breach and help your business stay GDPR compliant. 

Firstly, your training should cover the importance of protecting consumer information. Secondly, the training could cover how to correctly handle and store a person’s information. Finally, you could discuss the importance of not using personal devices to access customer data. 

Key Takeaways

To remain GDPR compliant, e-commerce businesses must handle their customers’ personal information with care. E-commerce businesses can face hefty fines if they do not store information responsibly. So, to handle information correctly, your should register your business with the ICO to regulate your general data storage practices. Secondly, you should draw up a privacy policy and improve your cyber security practices. This ensures the devices you are storing personal information on are securely encrypted and password protected. Finally, it is also advisable to get a lawyer’s advice when drafting a privacy policy or assessing whether your e-commerce business may have any data security issues.

If you need advice on how your business can stay GDPR compliant, our experienced contract lawyers can assist as part of our LegalVision membership. For a low monthly fee, you will have unlimited access to lawyers to answer your questions and draft and review your documents. Call us today on 0808 196 8584 or visit our membership page.

Frequently Asked Questions