An online shop collects several categories of personal data and works with a series of outside providers — payment, courier, email marketing, analytics. Each interaction brings its own obligations, under the GDPR and under the Romanian ePrivacy law. This guide summarises them for anyone running an online shop in Romania, with a 10-point checklist at the end.
What data an online shop collects
- Customer account
Email, password (stored hashed), name, phone, registration date. Basis: performance of the contract (Article 6(1)(b)).
- Order data
Delivery and billing address, products, amounts; for business customers, the tax code and company name. Basis: contract, and legal obligation for invoicing and accounting.
- Payment data
Card number and security code are not stored by the shop; they are handled by the payment provider. The shop keeps the transaction reference and status. Basis: contract and legal obligation.
- Delivery data
Sent to the courier. Basis: contract. Whether the courier is a processor or an independent controller depends on how it operates; many act as controllers for their own part.
- Marketing data
Newsletter subscriptions, preferences, campaign history. Basis: consent, or the existing-customer exception in Article 12(2) of Law no. 506/2004.
- Tracking data
Cookies, IP address, browsing behaviour, abandoned carts, retargeting. Needs prior consent through a compliant banner (Article 4(5) of Law no. 506/2004).
- Reviews and complaints
Published reviews, complaints by email or form, customer support correspondence. Basis: legitimate interest, and legal obligation for handling consumer complaints.
Obligations specific to e-commerce
On top of the general obligations (see GDPR in Romania — what every company should know), an online shop has to cover:
- A detailed, accessible privacy notice
A permanent link in the footer. Controller identity (company name, tax code, address, DPO contact if any), purposes by category, lawful bases, recipients (payment, courier, hosting, analytics), retention periods, transfers outside the EU, rights.
- Agreements with processors
Under Article 28, every provider that processes data on the shop’s behalf needs a written agreement — which includes electronic form, so accepting a provider’s online terms that incorporate a DPA is valid. What matters is that the agreement exists, covers Article 28(3) and is kept on file.
- A valid basis for direct marketing
Unticked boxes for the newsletter at registration and checkout; the existing-customer exception only for similar products; an easy, free way to unsubscribe in every email.
- A compliant cookie banner
Non-essential cookies (analytics, advertising, retargeting) are not set until the user consents.
- A working process for data subject rights
A published address, a form in the customer account, a documented procedure and an answer within one month. Typical requests: access, account deletion, portability (order export), rectification.
- Breach notification within 72 hours
A written procedure for identifying, assessing and notifying incidents to ANSPDCP. Online shops are frequent targets; the procedure has to exist before the incident.
Processors and independent controllers
Not every provider is a processor. The role follows what the provider actually does with the data, not the label in the contract:
Usually processors — DPA needed
hosting, SaaS e-commerce platform, email marketing, CRM, customer support chat, analytics, review collection on the shop’s behalf
Often independent controllers — check
payment institutions (which have their own regulatory obligations), couriers, marketplaces, some advertising platforms
A payment institution that processes card data under its own regulatory obligations decides part of the processing itself; most act as independent controllers for that part and say so in their terms. For them, the privacy notice names them as recipients. For processors, the agreement has to be in place. For US providers, the transfer is covered by the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise by standard contractual clauses.
Email marketing — the Romanian rule
Commercial email in Romania is governed first by Article 12 of Law no. 506/2004, which transposes the ePrivacy Directive. Two situations:
Needed for newsletter sign-ups from people who have not bought anything, leads from sign-up forms and contact lists obtained from third parties. Form: an unticked box and a clear text on what will be sent and how often. Keep the evidence: time, source, the text shown.
Where the shop obtained the email address directly from the customer in the context of a sale, it may send messages about its own similar products or services, provided the customer was clearly offered a simple, free way to object when the address was collected, and is offered it again in every message. General campaigns unrelated to what the customer bought fall outside the exception.
Every marketing email needs a working unsubscribe link and must identify the sender. Technical authentication (SPF, DKIM, DMARC) is not a legal requirement, but without it the messages tend not to arrive.
Cookies, tracking and retargeting
Online shops are among the heaviest users of tracking: Google Analytics, the Meta Pixel, Google Ads, session recording, retargeting, abandoned cart recovery. All of it needs prior consent through a compliant banner. The details — categories, equal choices, cookies set only after consent — are in cookie banners and GDPR in Romania.
Sector-specific risks
- Online pharmacies and health products
Order data can reveal health conditions — special category data under Article 9. This needs a valid exception under Article 9(2), stronger security and, on a large scale, a DPIA.
- Personalised recommendations
Detailed customer profiles. Profiling has to be disclosed in the privacy notice, and the customer can object to profiling for direct marketing at any time (Article 21(2)). A recommendation engine is not, as such, subject to the AI Act transparency rules; a chatbot or generated content would be.
- B2B marketplaces
Data about companies is not personal data, but the data of contact persons, and of sole traders, is. The marketplace and the sellers need clearly allocated roles.
- Loyalty programmes
Extensive profiling and behavioural scoring. Systematic, large-scale evaluation of customers can trigger a DPIA under the ANSPDCP list.
E-commerce GDPR checklist — 10 points
- 1
A privacy notice that is published, easy to find and up to date (controller, purposes, bases, recipients, retention, rights)
- 2
A record of processing activities (Article 30), kept up to date
- 3
A data processing agreement with each processor, and the roles of payment providers and couriers checked and documented
- 4
A compliant cookie banner: equal choices, no non-essential cookie before consent
- 5
Unticked boxes for the newsletter, the existing-customer exception applied only to similar products, a working unsubscribe link in every email
- 6
A dedicated address for data subject requests, published in the notice
- 7
An internal procedure for answering requests within one month
- 8
A procedure for notifying breaches to ANSPDCP within 72 hours, with a template ready
- 9
Technical security measures: HTTPS, hashed passwords, two-factor authentication for administrators, backups, timely updates of the platform and plugins
- 10
Periodic training for the customer support team on data subject rights
Retail is one of the sectors ANSPDCP fines regularly. The cases are in GDPR fines in Romania — real cases.
Frequently asked questions
What personal data does an online shop collect?
Typically seven categories: customer accounts, order data, payment data (handled mainly by the payment provider), delivery data, marketing data, tracking data (cookies, IP address, browsing behaviour) and reviews and complaints. Each has its own lawful basis and obligations.
What are the main GDPR obligations of an online shop in Romania?
A privacy notice; a record of processing activities; data processing agreements with the providers that act as processors; a compliant cookie banner; a valid basis for marketing; a way to handle data subject requests within one month; and a procedure for notifying breaches to ANSPDCP within 72 hours.
Which providers need a data processing agreement?
Those that process data on the shop’s behalf: hosting, the e-commerce platform if it is SaaS, email marketing, CRM, customer support chat, analytics. Payment institutions and couriers often act as independent controllers for their own part; for them, the privacy notice lists them as recipients and a processing agreement is not the right instrument. The agreement must be in writing, which includes electronic form.
Can we send marketing emails without consent?
In Romania, Article 12 of Law no. 506/2004 requires prior express consent for commercial email. The exception: where the shop obtained the customer’s email address directly in the context of a sale, it may send messages about its own similar products or services, provided the customer was clearly offered a simple, free way to object when the address was collected and is offered it again in every message.
How should data subject requests be handled?
A dedicated address published in the privacy notice, a form in the customer account, an internal procedure for identifying the request, verifying identity proportionately and answering within one month, and a register of requests and answers. Ignoring requests is one of the most frequent causes of ANSPDCP fines.