GDPR for an online store

GDPR (the EU General Data Protection Regulation, Regulation 2016/679) is the EU law on processing personal data. It also applies to a store outside the EU if the store offers goods to people who are in the EU, or monitors their behavior there.

This is not legal advice: below is what the sources say, with links. For your case you need a GDPR lawyer.

When GDPR applies to a Ukrainian store

Under art. 3(2) GDPR, the regulation applies to non-EU companies if they process the data of people who are in the EU and the processing relates to:

• offering goods or services to those people, whether or not payment is required, or
• monitoring their behavior in the EU (GDPR, art. 3).

How do you tell whether you "offer" goods in the EU? Recital 23 says: it must be ascertained whether it is apparent that the company envisages offering goods to people in one or more EU countries. The mere accessibility of a website in the EU, an email address or contact details, or a language used in the seller's own country are not sufficient for this. A language or currency common in one or more EU countries, together with the possibility of ordering goods, as well as mentions of customers from the EU, may show such intent. Read the full text of recital 23 in the GDPR.

An illustrative example: a Ukrainian store whose site is in Polish, with prices in zloty and delivery to Warsaw, most likely "offers goods" in the EU. A store with only a Ukrainian version that delivers within Ukraine most likely does not, even if someone from abroad happened to open the site.

If GDPR applies to you, art. 27 requires you to appoint a written representative in the EU, but not for occasional processing that does not involve large-scale processing of special categories of data and is unlikely to put people's rights at risk (GDPR, art. 27). A store with regular orders from the EU is unlikely to fall under this exception: ask a lawyer.

What data a store collects

Name, phone, delivery address, email, order history, payment information, IP address, identifiers in cookies, newsletter subscription. All of this can count as personal data if it can be used to identify a person.

What a store must do: the main obligations

1. Have a basis for each processing activity (art. 6): consent; the needs of a contract (order and delivery); compliance with the law (accounting); a legitimate interest, if not overridden by the person's rights; and others. For an order the basis is usually the contract, for newsletters and ads, consent.
2. Follow the consent rules (art. 7): freely given, specific, informed, unambiguous; you must be able to prove consent; withdrawing it must be as easy as giving it. In assessing whether consent is freely given, the regulation says to take utmost account of whether performance of a contract is made conditional on consent to data that is not necessary for the contract (art. 7(4)). More: cookie banner.
3. Inform people (art. 13): who you are, why you collect data, who you pass it to, how long you keep it, what rights people have. This is the privacy policy on the site and next to forms.
4. Respond to requests: without undue delay and within one month of receiving the request; the period can be extended by two more months if the request is complex (art. 12(3)).
5. Have contracts with processors (art. 28): CRM, email, analytics, logistics.
6. Protect data and report a breach: without undue delay and, where feasible, within 72 hours of becoming aware of it, to the supervisory authority, if the breach is likely to put people at risk (art. 33).
7. Transfers of data outside the EEA: chapter V (art. 44 and following) sets conditions.
8. Record of processing (art. 30): the exemption for companies under 250 employees does not apply if the processing is not occasional, is risky or involves special categories of data. For a store with constant orders, it is simpler to keep a record.
9. Cookies and pixels: a separate rule of the ePrivacy Directive, see cookies and Consent Mode.

Fines

GDPR sets maximums, not fixed amounts: up to 10 million euros or 2% of worldwide annual turnover for the violations listed in art. 83(4); up to 20 million euros or 4% for the violations listed in art. 83(5), whichever is higher (GDPR, art. 83). How much is imposed in each case is decided by the supervisory authority; there are no specific fines for Ukrainian stores in open sources.

What is changing: Digital Omnibus

In November 2025 the European Commission proposed simplifying the rules (Digital Omnibus), including on cookies. The EDPB and EDPS, in Joint Opinion 2/2026 (10 February 2026), urged not to adopt the proposed changes to the definition of personal data (EDPB). According to a legal review, on 21 October 2026 the Council agreed a mandate: it left the definition of personal data in art. 4(1) unchanged and did not move the cookie rules into the GDPR; the European Parliament had not adopted a position by 24 October 2026 (Legal247). This is a proposal, not law: the current GDPR rules apply.

Common mistakes

• thinking GDPR is "not about us" because the store is in Ukraine, although the site targets buyers from the EU;
• collecting consent with an "I agree to everything" checkbox together with the terms of sale;
• having no privacy policy in the buyers' language;
• handing data to a third-party service without a contract;
• not knowing which employee is responsible for people's requests and breaches.

FAQ

Does a Ukrainian store have to follow GDPR? If you offer goods to people in the EU or monitor their behavior (art. 3(2)), yes. If you work only in Ukraine, GDPR does not apply to you, but the Ukrainian law does.

Do I need a representative in the EU? Under art. 27, if art. 3(2) applies, yes, apart from limited exceptions for occasional processing.

What is the fine for violating GDPR? The maximums: 10 million euros or 2% and 20 million euros or 4% of turnover depending on the violation (art. 83).

Do I need consent for a newsletter? Consent is one of the bases for processing (art. 6(1)(a)); newsletters are also covered by separate national rules, which are worth checking separately.

How long do I have to answer a person's request? One month, with a possible extension of two more (art. 12(3)).

Related terms

• Cookies
• Cookie banner
• Personal data in Ukraine
• CRM for an online store

Sources

• Regulation (EU) 2016/679 (GDPR), art. 3, 4, 6, 7, 12, 13, 27, 28, 30, 33, 83, recital 23 — eur-lex.europa.eu/eli/reg/2016/679/oj
• EDPB-EDPS, news on the joint opinion on the Digital Omnibus (11.02.2026) — edpb.europa.eu/news/digital-omnibus-edpb-and-edps-support-simplification-and-competitiveness-while-raising-key_en
• Legal247, Digital Omnibus and the GDPR: the Council mandate — legal247.no/en/insights/digital-omnibus-gdpr