GDPR for E-Commerce: A 2026 Checklist

Running an online store in Belgium (or anywhere in the EU) means you must comply with GDPR. Fines can reach up to €20 million or 4% of annual turnover . Here's your practical compliance checklist for 2026.

Cookie Consent (The #1 Issue)

No pre-ticked boxes — All non-essential cookies must be opt-in
Clear categories — Separate analytics, marketing, and functional cookies
Equal prominence — "Decline" must be as easy to click as "Accept"
No cookie walls — Don't block content until cookies are accepted
Consent Mode v2 — Required by Google since March 2024 for EU traffic

Privacy Policy Requirements

What data you collect and why (legal basis)
How long you retain data
Who you share data with (processors, third parties)
How users can exercise their rights (access, deletion, portability)
Your Data Protection Officer (DPO) contact info
Written in clear, plain language (not legalese)

Customer Data Handling

Data minimization — Only collect what you actually need
Purpose limitation — Don't use order data for marketing without separate consent
Storage limitation — Delete or anonymize data you no longer need
Right to erasure — Have a process for "delete my account" requests (30-day deadline)
Data portability — Be able to export a customer's data in machine-readable format

Email Marketing

Explicit opt-in — No pre-checked newsletter boxes at checkout
Easy unsubscribe — One-click, no login required
Record of consent — Store when and how each person subscribed
Soft opt-in exception — Existing customers can receive emails about similar products (Belgian law)

Third-Party Services

Data Processing Agreements (DPAs) — Required with every service that handles customer data
EU data residency — Prefer services that store data in the EU
Sub-processors — Know who your vendors share data with
US transfers — Ensure EU-US Data Privacy Framework compliance or Standard Contractual Clauses

Technical Security

HTTPS everywhere (TLS 1.2+)
Password hashing (bcrypt/argon2)
Regular security updates and patches
Access logging and monitoring
Data breach notification process (72-hour rule)

Quick Action Items

If you're launching or updating an e-commerce site, start here:

Implement a proper cookie consent banner with Consent Mode v2
Update your privacy policy with current data flows
Audit your third-party services and sign DPAs
Set up a process for data subject requests
Enable HTTPS and security headers on all pages