The General Data Protection Regulation (GDPR) is the EU law that governs how personal data is collected and used, and it applies to any online shop that sells to individuals, whatever its size. An e-commerce business does not carry out a single processing operation but several, each with different rules. The order relies on the contract, the invoice on a legal obligation, email offers on Spain’s e-commerce law (LSSI) and analytics cookies on consent. Knowing the legal basis of each one is what decides which legal texts the shop needs, which tick boxes go in its forms and what it can do with its customer base.
If you need legal advice on the terms and policies of your online shop in Spain, request a free initial assessment.
Each use of a customer’s data needs one of the legal bases in Article 6(1) of the GDPR, and the basis depends on the purpose, not on the data. The same email address is processed to send the order confirmation, as performance of the contract, and to send offers, on another basis and under the rules of the LSSI. The table shows the usual map for an online shop.
| Processing | Legal basis | What to bear in mind |
|---|---|---|
| Handling the order, payment and delivery | Performance of the contract (Art. 6(1)(b)) | Only the data needed to sell and deliver. Asking for more data than necessary is not covered by this basis |
| Customer account | Performance of the contract (Art. 6(1)(b)) with whoever creates it | Explain what it is for and allow it to be deleted |
| Invoicing and accounting | Legal obligation (Art. 6(1)(c)) | Data is kept for the periods set by commercial and tax law, even if the customer asks for erasure |
| Customer service, withdrawal and legal guarantee | Contract and legal obligation (Art. 6(1)(b) and (c)) | Claim data is kept while liability can still be enforced |
| Newsletter to people who have not bought | Consent (Art. 6(1)(a)) and Article 21.1 of the LSSI | Unticked box, separate from acceptance of the terms of sale |
| Email offers to customers | Legitimate interest (Art. 6(1)(f)) and Article 21.2 of the LSSI | Only products similar to those purchased, with a simple, free opt-out in every message |
| Abandoned cart email | Consent if the email is commercial and the person is not yet a customer | Without a previous purchase there is no prior contractual relationship and the Article 21.2 LSSI exception does not apply |
| Reviews with name or photo | Consent of the reviewer (Art. 6(1)(a)) | Explain how you check that reviews come from buyers |
| Analytics, advertising and pixels | Consent (Art. 6(1)(a)) and Article 22.2 of the LSSI | No non-essential cookie or pixel is activated before the user accepts |
| Payment fraud prevention | Legitimate interest (Art. 6(1)(f)) | Limit it to what is necessary and explain it in the privacy policy |
Consent does not fix a wrongly chosen legal basis. Article 6.3 of Spain’s data protection act (LOPDGDD) prohibits making the contract conditional on the customer consenting to processing unrelated to it. A single box that accepts both the terms of sale and the newsletter is not valid for the newsletter.
Spain’s Law 34/2002 on information society services and e-commerce (LSSI) prohibits, in Article 21.1, sending commercial communications by email that the recipient has not requested or expressly authorised. The GDPR decides whether the data can be processed and the LSSI decides whether the email can be sent, and the shop has to comply with both.
The only exception is in Article 21.2. A shop may write without prior consent to existing customers if three conditions are met:
The customer must also be able to object at the time of purchase and in every communication, through a simple and free procedure. Outside that exception, including subscribers who have never bought and abandoned carts by people who are not customers, prior consent is required.
Article 22.2 of the LSSI requires informed consent to store or access cookies and similar technologies on the user’s device, except technical cookies or those strictly necessary for the service the user requests. The basket, the checkout session or remembering the user’s cookie choice do not need consent. Analytics, advertising, social media pixels and remarketing do.
The Spanish Data Protection Agency’s guide on cookies (AEPD, in Spanish), updated in July 2023 in line with the European Data Protection Board guidelines, requires accept and reject options to be presented at the same level, without rejecting being harder than accepting. Its criteria apply from 11 January 2024. The EU Digital Omnibus proposal would exempt some uses, such as first-party audience measurement. It is still under negotiation, and the Council of the EU agreed its position on 21 October 2026, as we explain in our article on cookies after the Digital Omnibus. We explain it in our article on the Digital Omnibus and the changes to the GDPR.
An online shop shares data with several providers, and each one that processes it on the shop’s behalf is a processor. Article 28 of the GDPR requires a contract with each processor setting out the subject matter, duration, security measures and what happens to the data at the end. In a typical e-commerce business, these providers are processors:
The payment gateway and the carrier usually act partly as controllers of their own processing, because their own regulations govern them. It is worth checking case by case what role each one declares in its terms.
If any provider stores or accesses the data outside the European Economic Area, Articles 44 et seq. of the GDPR on international transfers also apply. For US providers certified under the EU-US Data Privacy Framework, the Commission’s adequacy decision is enough. For the rest, safeguards such as standard contractual clauses are needed, and the shop has to disclose the transfer in its privacy policy.
Besides choosing the right legal bases, the GDPR requires the online shop to be able to demonstrate compliance. The minimum it needs in writing is this:
A data protection officer is not mandatory for most shops. Article 34.1.d of the LOPDGDD requires one from information society service providers that profile their users on a large scale, in line with Article 37(1)(b) of the GDPR.
Café de Altura, a fictitious online shop selling specialty coffee, has 4,000 customers, a newsletter with 9,000 subscribers and a social media remarketing campaign. Its checkout form has a single box, «I accept the terms and want to receive news», and its cookie banner only offers «Accept» and «Settings».
The review of the shop shows three problems. The single box does not give valid consent for the newsletter, because it is tied to the purchase. The banner does not allow users to reject at the same level as accepting, as the AEPD guide requires. And the email marketing platform stores data in the United States without the privacy policy saying so.
The fix is to separate the newsletter box, write to customers without consent only with offers of coffee and accessories, under Article 21.2 of the LSSI, and ask the remaining subscribers for consent. The reject button has to be added to the banner, the provider’s certification under the Data Privacy Framework checked and the policy updated. None of these changes requires rebuilding the shop.
Data protection is one of the layers of e-commerce regulations in Spain, together with the LSSI, consumer rights and the DSA.
In most cases, no. Article 34.1.d of the LOPDGDD only requires one from information society service providers that profile their users on a large scale. A shop that sells and ships orders, with a newsletter and ordinary analytics, is not usually in that situation, although it can appoint one voluntarily.
Yes, under three conditions in Article 21.2 of the LSSI. The customer must have bought before, their email must have been obtained in that purchase and the offer must concern your company’s products similar to those they bought. You must also let them object at the time of purchase and in every email, simply and free of charge.
If the person who abandoned the cart is already a customer and the email offers products similar to those they bought, the Article 21.2 LSSI exception applies. If they have never bought, there is no prior contractual relationship and a commercial email needs their prior consent, which can be requested with a box in the checkout itself.
Yes, if the tool stores cookies or reads information from the user’s device. Article 22.2 of the LSSI only exempts technical and strictly necessary cookies, and analytics is neither. The Digital Omnibus proposal would exempt first-party audience measurement, but it has not been adopted.
It is a personal data breach. You have to notify the AEPD within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to customers, under Article 33 of the GDPR. If the risk is high, you also have to inform the affected customers. Document the breach and the measures taken even if you do not notify it.
Sorting out the legal bases of an online shop takes little time and avoids the most frequent problems, which almost always lie in a tick box, a banner or a provider without a contract. At Innovatech we review the data protection of online shops together with the rest of their legal documentation, as part of our legal service for online shop terms and policies in Spain. Get in touch for a free initial assessment.
Marta Suárez-Mansilla is Managing Partner of Innovatech Legal and a Spanish lawyer (abogada), Madrid Bar (ICAM), working in technology law. She completed Harvard Law School's Copyright course and BerkeleyX's Blockchain programme, and has advised technology companies for more than eight years.