E-commerce combines many data flows: accounts, orders, addresses, payments, delivery partners, ad platforms and marketing messaging.
Map the flows
- Order fulfilment may rest on legitimate use or contract-like necessity - document the ground.
- Marketing needs its own, separate, withdrawable consent where consent is the ground.
- Payment gateways, couriers, SMS and email providers are processors - contract and record them.
Retention
The Rules prescribe specific retention timelines for certain large platforms. Even if you are smaller, define how long you keep order and account data and why.
Marketing hygiene
- Unticked boxes.
- One-click unsubscribe.
- Stop processing and tell processors when consent is withdrawn.
Frequently asked questions
Can I keep order records after a customer asks me to delete their account?+
Possibly, where law requires retention (for example tax or accounting). Record the legal basis and delete what is not required.
Relevant provisions
- Section 6(1)-(3)Valid consent for processing
- Section 6(4)Withdrawal as easy as giving consent
- Section 8(2)Processors engaged under valid contract
- Section 8(5)Rule 6 · pending verificationReasonable security safeguards
- Section 8(7)Rule 8 · pending verificationErasure when purpose is served or consent withdrawn
Official sources
Legal reviewPending legal review · drafted 19 Oct 2026
See where your business stands.
Run a free evidence-based website scan or talk to a compliance specialist about implementation.