{"id":14150,"date":"2018-05-03T11:20:12","date_gmt":"2018-05-03T08:20:12","guid":{"rendered":"https:\/\/www.x-cart.com\/?p=14150"},"modified":"2023-09-12T09:23:24","modified_gmt":"2023-09-12T06:23:24","slug":"gdpr-is-almost-here-impacting-online-stores-in-eu-and-outside-x-cart-is-ready","status":"publish","type":"post","link":"https:\/\/www.x-cart.com\/blog\/gdpr.html","title":{"rendered":"GDPR: What Is It and How It May Impact Ecommerce Stores in EU and Outside"},"content":{"rendered":"\n

The EU General Data Protection Regulation<\/a> (GDPR) law with complicated requirements, expensive implementation and huge fines for non-compliance have thrown many eCommerce businesses into panic since it was announced.<\/p>\n\n\n\n

This new EU regulation will impact business not only in the EU but those outside too, if they process the EU residents\u2019 personal data (collect emails, monitor site visitors behavior by IP, etc). And wherever your business is, the EU authorities will find the ways to punish you for non-GDPR-compliance.<\/p>\n\n\n\n

Starting from May 25, 2018<\/strong>, the GDPR law may affect how the processors and controllers collect, use, store and maintain personal data of the EU citizens. However, many businesses are not ready yet.<\/p>\n\n\n\n

According to the Mailjet\u2019s study<\/a>, only one of four businesses is GDPR-compliant, while the research by Erwin<\/a> has revealed that only 6% of the USA enterprises are ready for the new GDPR requirements.<\/p>\n\n\n\n

Are you also among those who ignore the GDPR requirements?<\/p>\n\n\n\n

Well, you may have strong reasons for it. But let\u2019s take a closer look at this EU regulation to understand what it is, how it applies to eCommerce businesses and what changes you need to implement to avoid fines.<\/p>\n\n\n

\n What is GDPR? <\/h2>\n\n\n\n

The aim of General Data Protection Regulation is to protect personal data of the EU citizens and make sure that online stores, cloud services and other companies with internet presence treat this data carefully and don\u2019t abuse it. These organizations should process the data lawfully and use it only for the purposes it was collected for.<\/p>\n\n\n\n

So, it\u2019s not only about your online store security<\/a> in general, but mainly about the ways you process your buyers\u2019 data.<\/p>\n\n\n\n

\n

Processing<\/strong> means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.<\/p>\n<\/div>\n\n\n\n

According to the regulation, personal data processing in the online store can take place only if:<\/p>\n\n\n\n

  1. a buyer gave an explicit consent to have his\/her personal data processed and knows that the processor needs this data to sell a product or render a service to the buyer.
    For example, the buyer\u2019s credit card number is necessary to accept the payment, the buyer\u2019s address \u2013 to ship the order correctly, cookie identifiers \u2013 to deliver more personalized experience, monitoring the buyer behavior \u2013 to offer more relevant products using the AI technologies, etc.<\/li>
  2. the data processing is required by law.<\/li><\/ol>\n\n\n

    \n Whom Does GDPR Affect? <\/h2>\n\n\n\n

    Geographically this regulation applies to businesses both inside and outside the EU if they process personal data of the buyers \u201cwho are in Union\u201d<\/strong> (as per Article 3).<\/p>\n\n\n\n

    It means, that while the EU citizens are not in Union, the GDPR doesn\u2019t apply to the processing of their data. But while they are, every processor and controller from the EU, the USA, China or any other country should process their data in a GDPR-compliant manner.<\/p>\n\n\n\n

    \n

    Controller<\/strong> is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of personal data processing of; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.<\/p>\n\n\n\n

    Processor<\/strong> means a natural or legal person, public authority, agency or another body which processes personal data on behalf of the controller.<\/p>\n<\/div>\n\n\n\n

    eCommerce business owners can be both processors and controllers because no online order is possible without asking a customer at least for their name and contact info. The data they collect, store and use falls within the scope of the GDPR if it belongs to the buyers in the EU.<\/p>\n\n\n\n

    So, online merchants should follow the new rules unless they stop selling to the EU customers (e.g. restrict checkout for buyers from the EU) and don\u2019t deal with their data at all. But it is hardly possible and may result in significant loss of revenue.<\/p>\n\n\n\n

    That said, online merchants should get prepared for the GDPR:<\/p>\n\n\n\n