Guide

Online shop and data protection: what GDPR requires

As soon as personal data is processed in an online shop, clear obligations apply. What these are specifically, what's almost always missing in practice, and what actually suffices.

Request assessment ↗Online shop

Quote on request6 to 12 weeksAs of 2026

In short

Once an online shop processes personal data, you need a legal basis, purpose limitation, defined deletion periods, information for data subjects, and a data processing agreement with every service provider involved. In practice, the same three points are almost always missing: the deletion period, the notice at the point of collection, and clarification of whether the provider uses the data for its own training.

01 — Data Protection

What GDPR requires

As soon as personal data is processed — and that happens faster than expected, for instance as soon as someone enters a name or phone number — the usual obligations apply: name the legal basis, define the purpose, maintain data minimization, define retention periods, inform data subjects.

In practice, that means for an online shop: a data processing agreement with every service provider involved, verification of where processing takes place, a documented deletion period, and a clear section in the privacy policy. Three things are almost always missing in practice: the defined deletion period, the notice at the point where data is collected, and clarification of whether the provider uses the data for its own training.

A data protection impact assessment is only required when there's likely high risk — not for most projects of this type. The review itself should still be documented so that if questions arise, it's clear why it was omitted.

02 — Contract

What needs to be clarified in writing

Ownership of data and access. They belong to the client. If a provider won't clearly confirm this, that's the most important information from the conversation.
Handover upon termination. In what format, within what timeframe, at what cost.
No minimum term without consideration. Lock-in is justifiable if something is delivered in return — otherwise not.
What a later change costs. The total cost isn't determined by the project price, but by the hourly rate in year three.
Documentation as a deliverable. Not as a promise, but as a line item in the proposal.

03 — Risks

What can go wrong

The system answers incorrectly. Containable by having it work exclusively from verified content and escalate when uncertain rather than guess. This is a configuration decision, not a property of the technology.
The effort is underestimated. Most common reason: unclear starting situation. An honest assessment of the current state before the proposal prevents this more reliably than any buffer.
No one maintains it. The biggest risk of all — and the most easily avoidable.
Data protection gaps. Almost always arise from missing deletion deadlines and unclear responsibility, rarely from the technology itself.
Vendor lock-in. Avoidable if access credentials, data, and documentation contractually remain with the client.

04 — Questions

Frequently asked questions

Can we sell internationally?

Yes, that's a matter of setup, not platform: languages, currencies, shipping zones and tax rates per target country need to be configured properly — we plan that in from the start if desired.

Shopify, WooCommerce or something else?

Shopify if you want to start quickly and can live with the ongoing fees. WooCommerce if you already run WordPress and have someone who does updates. With complex inventory management, it's worth looking at specialized systems. There's no answer that's right for everyone.

What does ongoing operation cost?

Platform fees, payment providers, hosting and maintenance are ongoing costs, even before the first order comes in. How much that is in each case depends on the chosen platform and the product range — we calculate this transparently in the quote so there are no surprises.

Can we migrate from an existing shop?

Yes, with transfer of products, customers and order history. Redirects from the old product URLs are important — without them you lose the visibility of the previous pages.

How many products are still manageable without expensive additional systems?

Up to a few hundred products, the standard features of common platforms are perfectly sufficient. Only with several thousand products with complex variants is it worth looking at specialized inventory management.

What about returns?

The cancellation policy and the technical process for returns are part of the legally compliant basic setup. How you handle returns in practice remains your decision — we implement what you define.

Does our shop need to be accessible?

Yes, very likely. Online shops in consumer business are explicitly listed in the Austrian Barrierefreiheitsgesetz (Accessibility Act), which has been in effect since June 28, 2025. The exemption for micro-enterprises applies to services, not to product sales. Violations can be penalized with administrative fines up to 80,000 euros.

05 — Next

Online shop by region

Next step

Send us a few sentences about your project.

We read every inquiry ourselves and respond personally. No sales team, no callback form into the void.

Send inquiry ↗ office@pipeline-solutions.at OR +43 681 207 64 203