E-commerce, online store and privacy

What we do

For e-commerce organizations, the laws and regulations regarding privacy and data protection are complex. The legislature has established additional rules in connection with consumer protection, resulting in extra work. Examples include certain information obligations regarding websites or regulations concerning cookies. Compliance with these laws and regulations is mandatory, as otherwise enforcement action may be taken by a supervisory authority (for example, by means of a fine). Within our practice group, we have the knowledge and experience to provide organizations with legal advice in this regard.

Questions about e-commerce? Please contact us.

E-commerce and privacy within Privacy and data protection

An online store relies on personal data. From the first visit to the website through delivery, returns, and after-sales, you process names, addresses, email addresses, payment details, order history, and browsing behavior. Consequently, every webshop—from an international e-commerce group to the baker with an order page on the corner—falls under the General Data Protection Regulation (GDPR) and the GDPR Implementation Act. This page specifically examines e-commerce from the perspective of Privacy and Data Protection: not the general rules of consumer law, but rather the question of how you lawfully process, secure, and account for customer data. Our mixed teams of lawyers and in-house counsel translate these rules into workable agreements that suit the size and risk profile of your webshop.

Legal basis and purpose limitation in the processing of customer data

According to Article 6 of the General Data Protection Regulation, every processing of personal data requires a valid legal basis. In the case of a webshop, the data required to process, deliver, and pay for an order is typically based on the performance of the contract. For a newsletter, personalized offers, or non-functional cookies, consent is usually required. Furthermore, pursuant to Article 5 of the General Data Protection Regulation, purpose limitation and data minimization apply: you may only collect data that is necessary for a predetermined purpose and retain it no longer than necessary. A common mistake is ticking the marketing consent box by default or retaining complete order histories without a retention period. We determine the correct legal basis for each data stream and establish a sustainable retention policy.

Privacy statement, cookies and consent on your webshop

The GDPR requires you to clearly inform data subjects in advance (Articles 13 and 14 of the General Data Protection Regulation). A webshop therefore needs an accessible and understandable privacy statement that specifies which data you process, for what purpose, on what legal basis, how long you retain it, and with which parties you share it. In addition to the GDPR, Article 11.7a of the Telecommunications Act also applies to cookies: prior, active consent is required for tracking and analysis cookies that process personal data — a cookie banner without a genuine opt-out option is insufficient. The Dutch Data Protection Authority strictly enforces this. With our cookie scan , we map out which cookies your shop places and configure consent in a GDPR-compliant manner.

Processor agreements with payment services, fulfillment, and marketing

A webshop rarely operates in isolation. Payment service providers, hosting providers, fulfillment centers, email and marketing tools, and parcel carriers gain access to customer data. Pursuant to Article 28 of the General Data Protection Regulation, you are required to enter into a data processing agreement with every party processing data on your behalf, including agreements regarding security, data breaches, sub-processors, and the deletion of data after completion. If you use services outside the European Economic Area—such as US marketing or analytics platforms—additional transfer requirements under Chapter V of the General Data Protection Regulation apply. We review and negotiate these contracts and draft model agreements that you can use time and again.

Security, data breaches and the rights of your customers

Article 32 of the General Data Protection Regulation (GDPR) obliges you to implement appropriate technical and organizational measures, such as a secure (TLS) connection, strong access security, and authorization management in your webshop and POS systems. If things do go wrong, you must assess the data breach and, if necessary, report it to the Dutch Data Protection Authority within 72 hours and potentially to the customer (Articles 33 and 34 of the General Data Protection Regulation). In addition, your customers have rights: access, rectification, erasure, and objection (Articles 15 to 22 of the General Data Protection Regulation), and extra safeguards apply to profiling for personalized offers. Read more about our approach to data breaches . A DPIA may be mandatory for sensitive or large-scale processing .

Enforcement, fines, and how MKB Juristen unburdens you

The Dutch Data Protection Authority can impose fines of up to 20 million euros or 4% of global annual turnover (Article 83 of the General Data Protection Regulation), in addition to reputational damage and the shutdown of your sales channel. The standard is the same for both large e-commerce players and small business owners, but the practical approach differs. That is why we work with mixed teams of lawyers and in-house counsel: from a quick compliance check for a start-up webshop to a comprehensive privacy program for an international platform. If you would like to know where you stand first, we can conduct a privacy audit or appoint a Data Protection Officer (DPO) . Do you have questions about e-commerce and privacy? Please feel free to contact us.