Technology and data protection has had a significant impact on both traditional brisk & mortar and eCommerce retailers.

The Privacy and Electronic Communications Regulations (PECR), along with the GDPR mean all retailers must pay special attention to maintaining their sales and marketing databases, recording consent and managing data retention and disposal.

Multi-site retail chains often have different systems in different stores, many of them paper-based, and should consider data minimisation techniques to ensure they don’t hold unnecessary data.  Staff training across stores is often needed to ensure all employees understand their responsibilities with regard to data protection.

This page explains what data protection legislation means for retail & eCommerce organisations and the key areas they need to consider when managing personal data.

WHAT DOES THE LEGISLATION MEAN FOR RETAIL AND ECOMMERCE ORGANISATIONS?

Like all other organisations, retail and eCommerce organisations must:

ok2
Be transparent in the way they process personal data and accountable for doing so
ok2
Be able to detect, manage, report and respond to data breaches including, if necessary, liaising with the Information Commissioner’s Offfice (ICO)
ok2
Understand the data they have, where it is stored and who has access to it
ok2
Implement robust processes and procedures to protect personal data
ok2
Allow all customers, suppliers and staff to:

  • Access the data stored on them
  • ensure the data is correct and modify it as necessary
  • Have it deleted (unless needed for legitimate reasons

ok2
Appoint a designated data protection officer if they:

  • Process data on a large scale
  • Use the data for profiling or automated decision making

IMPORTANT DATA PROTECTION CONSIDERATIONS FOR RETAIL & ECOMMERCE

Retail and eCommerce organisations must protect personal data in a wide range of their operations.  Some major considerations include:

Sales and Direct Marketing

  • Managing consent of individuals receiving direct marketing materials
  • Impact of Personal Electronic Communications Regulation (PECR) and ePrivacy
  • Data retention
  • Data base management and data minimisation

eCommerce

  • Data held in contact forms
  • Large quantity
  • Financial, payment and transactional details
  • Automatic profiling
  • Cookies and tracking pixels

Multiple bricks and mortar outlets

  • Data held in multiple formats and locations
  • Minimising duplicated data
  • Disposal and retentions
  • Legacy and non-standard system
  • Paper systems

Staff and Training

  • Training staff to understand their protection responsibilities
  • Embedding a culture of data protection often across multiple sites staffed by part-time, temporary and permanent staff

Administration

  • Email systems
  • Staff payroll, pension and HR records
  • Access and security CCTV

Data Security

  • Maintaining network and server security
  • Data encryption

Policies and agreements

  • Privacy, retention and data protection policies
  • Staff handbooks
  • Data sharing agreements
  • Data processing agreements

If you would like to speak to us about any of our Data Protection consultancy services

 

Contact Us