GDPR for ecommerce: what UK shops actually have to do with customer data

UK GDPR, EU GDPR and PECR: which rules your shop answers to

The original GDPR is EU law, and it protects people by where they are, not by their passport. Since Brexit a UK shop works to UK GDPR, which kept the same principles, and the Information Commissioner's Office enforces it. Sell to people in the EU and the EU version can apply to their data too.

None of it is frozen. The ICO notes on its own email marketing guidance that the guidance is under review after the Data (Use and Access) Act. Read the current version, not a summary from a few years ago.

What GDPR asks of your email list on a normal Tuesday

Most of it is habits, not paperwork. We're not lawyers and this isn't legal advice, but this is what the law looks like from inside a Klaviyo account.

• A record of how and when each address joined, and what the form said that day
• Only the fields you'll use: a birthday you never email about is just a liability
• Unsubscribes honoured everywhere, straight away, including inside flows
• Answers to access and deletion requests, usually within a month
• A proper contract with every app that touches customer data, the small ones included

The sign-up form is where most of it starts. We've written up what a lawful sign-up looks like, from the tick box to the record you keep.

Erasing a customer without emailing them again by accident

Here's the trap. Somebody asks you to delete everything, so you delete their profile. Three months later they're back on the list, because an old export got imported over the top.

The usual answer is to delete the profile and keep the bare address on a suppression list, so the refusal outlives the data. Keep the refusal, lose the rest. The ICO's own email marketing checklist includes screening every send against a do not contact list.