--- title: 5 Requirements for GDPR and the Best Privacy Policy Generators to Meet them description: GDPR compliance is essential for eCommerce today if your website is at all visible to people in the European Union, regardless of where your business is actually located. Penalties for non-compliance are severe, so here are the 5 requirements you must fulfill to become GDPR-compliant. image: https://blog.shift4shop.com/hubfs/iStock-941717022.png --- [![eCommerce Blog](https://blog.shift4shop.com/hubfs/shift4shop/shift4-blog.jpg)](https://blog.shift4shop.com/) [![shift4shop logo](https://blog.shift4shop.com/hubfs/shift4shop/shift4shop-Black.png) |Blog](https://blog.3dcart.com/) [Sign Up](https://www.3dcart.com/freetrial.htm?utm_campaign=Blog&utm_source=blog&utm_medium=blog-cta&utm_content=free-trial-cta) [Subscribe](https://blog.shift4shop.com/5-requirements-your-website-must-meet-for-gdpr-compliance#subscribeBlock) [eCommerce News](https://blog.shift4shop.com/topic/ecommerce-news)| 6 min read # 5 Requirements for GDPR and the Best Privacy Policy Generators to Meet them By [Gonzalo Gil](https://blog.shift4shop.com/author/gonzalo-gil) [1 Comment](https://blog.shift4shop.com/5-requirements-your-website-must-meet-for-gdpr-compliance#comments-listing) ![](https://blog.shift4shop.com/hubfs/iStock-941717022.png) The European Union's General Data Protection Regulation (GDPR) is a regional law with global implications both in terms of its enforcement and its impact. So no matter where your company is located, if it does business with Europe, your ecommerce website must meet at least five requirements. The [GDPR](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN), which took effect May 25, 2018, requires you to clearly communicate what information you collect and how that information is used. You will also need a basis for collecting personal data, and you must answer customer requests for information or erasure. **So here are the five things your website needs.** ## Privacy Policy At its core, the GDPR is a personal privacy protection law. It clearly states that the protection of personal information is fundamental human right, and it sets out in 99 Articles and 173 recitals to regulate and defend that right. So it should be little wonder that your ecommerce site is going to need a clear and specific privacy policy to meet GDPR requirements. While there is not necessarily a format your company must follow, you are going to want to include six concepts: 1. Identification 2. Data collection 3. Data use (processing) 4. Data storage 5. Data sharing 6. Data control These concepts can be expressed in several sections. For example, 3dcart's GDPR-compliant [personalized privacy policy generator](https://www.3dcart.com/personalized-policy.html) includes nine sections that collectively speak to the GDPR's essential requirements.   Here are the sections covered. - **Section One: Transactional Information** — describes what your company does with a data subject's personal information and includes email subscriptions. - **Section Two: Consent** — describes how consent is given and withdrawn. - **Section Three: Disclosure** — let data subjects know if information is shared. - **Section Four: Online Store** — discloses information about your [ecommerce platform](https://www.3dcart.com/)and payment processing. - **Section Five: Third-party Services** — identifies the use of third-party solutions which may also collect and process personal information. - **Section Six: Security** — explains what your company and your ecommerce platform do to protect personal information. - **Section Seven: Do Not Track** — explains cookies and how they work on your site. - **Section Eight: Age of Consent** — addresses the minimum legal age of consent. - **Section Nine: Changes to this Privacy Policy** — discloses the right to make amendments. Your business will have three options for creating the required privacy policy. - [Hire an attorney](https://jknylaw.com/blog/what-is-the-difference-between-lawyer-and-attorney/) to write a privacy policy for your business. - Use [a privacy policy generator](https://www.3dcart.com/personalized-policy.html). - Write your own using examples. ##  Best Privacy Policy Generators for GDPR Compliance 1. **[3dcart GDPR Policy Generator](https://www.3dcart.com/personalized-policy.html)**[![gdpr-policy-generator](https://blog.shift4shop.com/hs-fs/hubfs/gdpr-policy-generator.png?width=1283&name=gdpr-policy-generator.png)](https://www.3dcart.com/personalized-policy.html) 2. **[Iubenda](https://www.iubenda.com/en/privacy-and-cookie-policy-generator)** ![iubenda-policy-generator](https://blog.shift4shop.com/hs-fs/hubfs/iubenda-policy-generator.png?width=1320&name=iubenda-policy-generator.png) 3. [**Termly** ![termly-policy-generator](https://blog.shift4shop.com/hs-fs/hubfs/termly-policy-generator.png?width=1171&name=termly-policy-generator.png)](https://termly.io/products/privacy-policy-generator/) 4. [**PrivacyPolicies.com** ![privacy-policies-generator](https://blog.shift4shop.com/hs-fs/hubfs/privacy-policies-generator.png?width=1141&name=privacy-policies-generator.png)](https://privacypolicies.com/) 5. [**TermsFeed** ![termsfeed-gdpr-policy](https://blog.shift4shop.com/hs-fs/hubfs/termsfeed-gdpr-policy.png?width=1292&name=termsfeed-gdpr-policy.png)](https://termsfeed.com/privacy-policy/generator/?ref=blog-sidebar-start-here) 6. **[FreePrivacyPolicy.com](https://www.freeprivacypolicy.com/free-privacy-policy-generator.php)** ![freeprivacypolicy](https://blog.shift4shop.com/hs-fs/hubfs/freeprivacypolicy.png?width=1259&name=freeprivacypolicy.png) ## Consent on Forms In the GDPR, consent is a person's genuine right to control his or her data. And your company is going to need to ask for consent for the use of cookies, email subscriptions, contests, wish lists, and user accounts. Consent must be freely given, specific, informed, and unambiguous. While your business does have some flexibility regarding how consent forms or consent for cookies are implemented, you will need to cover key concepts, like describing why your business is collecting the data and how it will be processed; providing the option to opt-out or withdrawn consent at any time; the legal basis for data collection; and access to your business' privacy policy. How you present these concepts can vary. It may also be a good idea to "unbundle" consent, so rather than asking a site visitor to approve all cookies, for example, you might give them the choice to accept essential cookies necessary for the site to function while rejecting marketing cookies that monitor shopping behaviors. ## Consent at Checkout When a customer makes a purchase on an ecommerce site that customer understands that in order to receive the items purchased, he or she will need to provide personal data like a name, address, and payment card. To be clear, your ecommerce operation does not need consent to process an online order. The GDPR provides six valid and lawful bases for the collection and processing of personal data. These bases are consent, contract, legal obligation, vital interest, public interest, and legitimate interests. An ecommerce checkout may be considered a form of a contract, since the data subject has specifically asked your business to do something — deliver a product — that requires the collection and processing of personal information. However, there are a couple of things you may need to include on checkout pages. First, you may still need to inform shoppers about your privacy policy and about what information is collected and processed during checkout. Second, you will need consent if you also want to market to shoppers. As an example, if you have a checkbox in your shopping cart that says "add me to the email list," your company will need to get consent, since subscribing to an email list is not necessary for the completion of the order. Similarly, if you ask a shopper to create a customer account at checkout, you will need consent. ## Requests for Records The GDPR allows for subject access, meaning that anyone covered by the GDPR whose data your business has collected has the right to request a record of all of the information you have about them. Data subjects can submit a request in verbal or written form to any part of your business, and they do not need to specifically mention the GDPR. Your company will need to respond quickly. Here again, the GDPR doesn't provide a specific template, but response best practices include: - Identifying all the places (databases) personal data is stored in advance. - Developing a system (automated if possible) that will retrieve all of a customer's personal data. - Training employees to recognize requests. - Developing a central repository for all GDPR-related requests. - Identifying the individuals or departments responsible for handling requests. - Creating form letters and responses. - Validating each request. - Keeping a record of all requests and your company's response for audit purposes. You may want to mention this right in your privacy policy and even create a form for requests, just remember your customers don't have to use a specific form to make a valid request. ## Requests to Delete Data The GDPR also includes a right to erasure or a right to be forgotten. With this right, a person covered by the GDPR can contact your company in the same way he or she would for a record request, but instead of asking for a copy of the personal data your business has collected, he or she can demand that you delete it, effectively forgetting them. ![gdpr-frontend-1](https://blog.shift4shop.com/hs-fs/hubfs/gdpr-frontend-1.png?width=1090&name=gdpr-frontend-1.png) This right is not absolute. There are at least five instances when you would not comply, including for the purpose of freedom of expression and information; to meet a legal obligation; for the public interest; for public scientific or historical research with overarching benefits to the public; and for legal claims. Follow the same best practices recommended for the request for records, but be prepared to delete the personal data and ask third-party partners to do the same. ***Want to learn the fastest way to make your website fully GDPR-compliant? Download our free ebook below.*** [![Free report: The Real Cost of Running a Shopify Store](https://no-cache.hubspot.com/cta/default/3365633/ab767db2-b6f5-4a18-a310-5d0dd9c1b8b7.png)](https://cta-redirect.hubspot.com/cta/redirect/3365633/ab767db2-b6f5-4a18-a310-5d0dd9c1b8b7) - [Tweet](https://twitter.com/share) ### Leave a reply or comment below ### Sign up for Marketing Tips ### Related posts [Top 10 Trends That Will Shape eCommerce in 2023](https://blog.shift4shop.com/trends-ecommerce-2023) The future of eCommerce is exciting, but marketers have a lot of work to do to stay on top of the latest trends and developments. [Read More](https://blog.shift4shop.com/trends-ecommerce-2023) February 16, 2023 [Contextual Commerce and How It Disrupts the Online Retail Space](https://blog.shift4shop.com/contextual-commerce-disrupts-online-retail) Contextual commerce can be a huge asset in your business’s overall digital strategy. It’s enabled by technologies that are either already here or are coming down the line. In either case, it’s ... [Read More](https://blog.shift4shop.com/contextual-commerce-disrupts-online-retail) May 19, 2022 [Get Your Business Going with the Shift4Shop Launch Checklist](https://blog.shift4shop.com/launch) It takes a lot of work to start a business, but to an entrepreneur, there are few things as rewarding. Building a profitable business from the ground up, and seeing it thrive, is a goal shared by ... [Read More](https://blog.shift4shop.com/launch) February 01, 2021 [![3dcart logo](https://blog.shift4shop.com/hubfs/shift4shop/shift4shop-Black.png) |Blog](https://blog.3dcart.com/) ### Sign up for Marketing Tips [![New call-to-action](https://no-cache.hubspot.com/cta/default/3365633/fcff512b-4483-4b5f-b166-fec0d89749f8.png)](https://cta-redirect.hubspot.com/cta/redirect/3365633/fcff512b-4483-4b5f-b166-fec0d89749f8)   ### Resources [Apps & Integrations](https://blog.3dcart.com/topic/apps-integrations) [B2B Ecommerce](https://blog.3dcart.com/topic/b2b-ecommerce) [Conversion Optimization](https://blog.3dcart.com/topic/conversion-optimization) [Customer Service](https://blog.3dcart.com/topic/customer-service) [Digital Payments](https://blog.3dcart.com/topic/digital-payments) [Ecommerce Features](https://blog.3dcart.com/topic/ecommerce-features) [Ecommerce Marketing](https://blog.3dcart.com/topic/ecommerce-marketing) [eCommerce News](https://blog.3dcart.com/topic/ecommerce-news) [Email Marketing](https://blog.3dcart.com/topic/email-marketing) [Fraud Prevention](https://blog.3dcart.com/topic/fraud-prevention) [Holiday Shopping](https://blog.3dcart.com/topic/holiday-shopping) [Search Engine Optimization](https://blog.3dcart.com/topic/seo) [Shipping & Fulfillment](https://blog.3dcart.com/topic/shipping-fulfillment) [Social Media](https://blog.3dcart.com/topic/social) [Starting an Online Business](https://blog.3dcart.com/topic/starting-a-business) [Success Stories](https://blog.3dcart.com/topic/success-stories) [Web Design](https://blog.3dcart.com/topic/web-design)   ### Popular Articles Search Articles  [![](https://feedburner.google.com/fb/images/pub/feed-icon32x32.png)](http://feeds.feedburner.com/3dcartEcommerceBlog) [RSS Feed](http://feeds.feedburner.com/3dcartEcommerceBlog)  [![3dcart eCommerce Blog - Blog Directory OnToplist.com](https://www.ontoplist.com/images/ontoplist31.png?id=59e75cd39646e)](https://www.ontoplist.com/blogs/3dcart-ecommerce-blog_59e75cd39646e/) [Want to be a Guest Author?](https://blog.3dcart.com/guest-posts-application) Copyright © 2023 Shift4Shop. All Rights Reserved. ## Rocket Fuel for Your Business About Shift4Shop ![](https://www.shift4shop.com/2021/images/icons/dropdown-blue.svg) [Why Shift4Shop](https://www.shift4shop.com/why-3dcart.html) [Shopping Cart Software](https://www.shift4shop.com/shopping-cart-software.html) [Success Stories](https://www.shift4shop.com/lp/success-stories/) [Shift4Shop Reviews](https://www.shift4shop.com/shopping-cart-reviews.html) [eCommerce Blog](https://blog.shift4shop.com/) [Sitemap](https://www.shift4shop.com/sitemap.html) eCommerce ![](https://www.shift4shop.com/2021/images/icons/dropdown-blue.svg) [Features](https://www.shift4shop.com/all-features.html) [How to Sell Online](https://www.shift4shop.com/sell-online.htm) [Create a Website](https://www.shift4shop.com/build-ecommerce-website.htm) [Start an Online Store](https://www.shift4shop.com/start-an-online-store.html) [eCommerce](https://www.shift4shop.com/ecommerce-saas.html) [Online Store Builder](https://www.shift4shop.com/build-an-online-store.html) Resources ![](https://www.shift4shop.com/2021/images/icons/dropdown-blue.svg) [eCommerce Web Design](https://www.shift4shop.com/ecommerce-web-design.htm) [eCommerce Marketing](https://www.shift4shop.com/ecommerce-marketing-tools.html) [Custom Development](https://www.shift4shop.com/custom-development.html) [Start an Online Business](https://www.shift4shop.com/start-an-online-business.html) [App Store](https://apps.shift4shop.com/) [Theme Store](https://themes.shift4shop.com/) Technical Support ![](https://www.shift4shop.com/2021/images/icons/dropdown-blue.svg) [Support Center](https://support.3dcart.com/) [eCommerce Forum](https://forums.shift4shop.com/) [eCommerce University](https://www.shift4shop.com/lp/ecommerce-university/) [Developer Portal](https://developer.3dcart.com/) [Supported Payments](https://www.shift4shop.com/ecommerce-payment-gateways.html) Company ![](https://www.shift4shop.com/2021/images/icons/dropdown-blue.svg) [About Us](https://www.shift4shop.com/aboutus.htm) [Contact Us](https://www.shift4shop.com/aboutus.htm#contact-area) [Become a Partner](https://www.shift4shop.com/ecommerce-partners.html) [Affiliate Program](https://www.shift4shop.com/3dcart-affiliates.html) Copyright © 2025 Shift4Shop [Terms and Conditions](https://www.shift4shop.com/legal.html) [Privacy Policy](https://www.shift4shop.com/privacy.html) Copyright © 2025 Shift4Shop ```json { "@context" : "http://schema.org", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "United States", "addressLocality" : "Center Valley", "addressRegion" : "PA", "postalCode" : "18034", "streetAddress" : "3501 Corporate Pkwy " }, "alternateName" : "3dcart Shopping Cart Software", "areaServed" : { "@type" : "GeoCircle", "geoMidpoint" : { "@type" : "GeoCoordinates", "latitude" : "37.0902", "longitude" : "95.7129" }, "geoRadius" : "500 km" }, "description" : "Shopping Cart Software", "email" : "sales@3dcart.com", "image" : "https://www.3dcart.com/images/logo.png", "logo" : "https://www.3dcart.com/images/logo.png", "mainEntityOfPage" : { "@id" : "https://blog.shift4shop.com/5-requirements-your-website-must-meet-for-gdpr-compliance", "@type" : "WebPage", "description" : "GDPR compliance is essential for eCommerce today if your website is at all visible to people in the European Union, regardless of where your business is actually located. Penalties for non-compliance are severe, so here are the 5 requirements you must fulfill to become GDPR-compliant." }, "naics" : "5112", "name" : "3dcart", "sameAs" : [ "https://www.3dcart.com", "https://www.facebook.com/3dcart", "https://www.twitter.com/3dcart", "https://plus.google.com/+3dcart", "https://instagram.com/3dcart/", "https://www.youtube.com/3dcart", "https://www.linkedin.com/company/3dcart.com", "https://www.pinterest.com/3dcart" ], "telephone" : "8882762108", "url" : "https://www.shift4shop.com" } ``` ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Gonzalo Gil" }, "dateModified" : "March 24, 2022, 9:57:32 PM", "datePublished" : "2018-11-27 16:00:00", "description" : "GDPR compliance is essential for eCommerce today if your website is at all visible to people in the European Union, regardless of where your business is actually located. Penalties for non-compliance are severe, so here are the 5 requirements you must fulfill to become GDPR-compliant.", "headline" : "5 Requirements for GDPR and the Best Privacy Policy Generators to Meet them", "image" : { "@type" : "ImageObject", "url" : "https://cdn2.hubspot.net/hubfs/3365633/iStock-941717022.png" }, "mainEntityOfPage" : { "@id" : "https://blog.3dcart.com", "@type" : "WebPage", "description" : "eCommerce Blog by 3dcart" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.3dcart.com/images/logo.png" }, "name" : "3dcart" } } ```