In brief
- Regulations concerned: GDPR, NIS2.
- E-commerce operators process customer data at large scale and for multiple purposes: account management, order fulfilment, payment, loyalty, marketing, and profiling.
- GDPR (up to €20M or 4%) concentrates the bulk of the risk for e-commerce, with frequent checks on cookies and prospecting.
- E-commerce is primarily governed by GDPR: cookies, prospecting, and profiling concentrate audits and sanctions.
Regulatory deadlines
The key dates of the regulations applicable to your sector.
May 2018
RGPDEntry into application
In forceJanuary 2023
NIS2Entry into force (EU directive)
In forceOctober 2024
NIS2Transposition deadline (EU)
In force2026
NIS2French transposition (Resilience Act)
In forceWhy the 'E-commerce' sector is concerned
E-commerce businesses process customer data at scale and for multiple purposes: account management, order fulfilment, payment, loyalty, marketing, and profiling. GDPR is central here, with two recurring friction points: consent for cookies and trackers, and commercial prospecting.
Online marketplaces are classified as digital providers under NIS2: above the size threshold, they must manage cyber risks and notify incidents. A simple online shop is less directly targeted, but remains dependent on the security of its service providers.
Personalisation and recommendation are often powered by AI. Within the meaning of the AI Act, these uses generally fall under limited risk (transparency), while intrusive personalisation is primarily governed by GDPR (profiling) and, for large platforms, by the DSA.
GDPR — the heart of e-commerce
The e-commerce operator is the data controller for the entire customer journey. Key points of attention: consent for cookies and trackers (audience measurement, advertising), the legal basis for prospecting, marketing profiling, payment data security, and retention periods.
The transparency of information (privacy policy, compliant cookie banner) is a determining factor.
Key obligations
- Compliant consent for cookies and trackers.
- Legal basis for prospecting (consent/legitimate interest).
- Framework for marketing profiling.
- Payment data security and retention periods.
NIS2 — marketplaces
NIS2 classifies online marketplaces as digital service providers. Above the 'medium-sized entity' threshold, they fall under important entities: risk management measures, incident notification, and supply chain security.
A standard online shop below the threshold is concerned primarily indirectly, through its service providers.
Key obligations
- Risk management measures (Art. 21) for online marketplaces.
- Notification of significant incidents.
- Supply chain security (hosting provider, payment).
- Management accountability.
AI Act — recommendation and personalisation
Recommendation and personalisation engines are often powered by AI. Under the AI Act, these use cases generally fall under limited risk (transparency obligations regarding interactions and generated content). Intrusive profiling is primarily governed by GDPR; large platforms are additionally subject to the DSA.
Key obligations
- Transparency on recommendation systems and AI-generated content.
- Articulation with GDPR profiling.
- Vigilance over manipulative practices (prohibited by the AI Act).
Comparative overview of regulations
| Regulation | E-commerce scope | Flagship obligation | Max. Penalty |
|---|---|---|---|
| GDPR | Core Topic | Cookies + prospecting + profiling | 20 M€ / 4 % |
| NIS2 | Marketplaces | Risk management + incidents | €10 M / 2 % |
| AI Act | Recommendation | Transparency (limited risk) | €35 M / 7 %* |
How these regulations interact
E-commerce compliance starts with GDPR: cookies, prospecting and profiling are the focus of audits and sanctions. AI-driven recommendation integrates primarily through profiling (GDPR) and transparency obligations (AI Act, limited risk).
The NIS2 dimension depends on the business model: a marketplace qualifies as a targeted digital provider, while a traditional store is primarily affected indirectly. Payment data security is, in all cases, an imperative.
Application timeline
- 1GDPR. In force; frequent checks on cookies and prospecting.
- 2AI Act. Prohibitions (manipulative practices) in force since February 2025; transparency applies progressively.
- 3NIS2. French transposition under way; marketplaces to anticipate.
Applicable penalties
GDPR (up to €20M or 4%) concentrates the bulk of the risk for e-commerce, with frequent enforcement actions on cookies and direct marketing. NIS2 applies to online marketplaces (up to €10M or 2%). The AI Act targets, in this context, prohibited manipulative practices in particular.
Commercial risk (loss of trust, cart abandonment) accompanies regulatory risk: a non-compliant cookie banner or a payment data breach directly impacts sales.
Compliance roadmap
- 1Bring cookies into compliance. Compliant banner and consent, supervised audience measurement.
- 2Govern prospecting. Legal basis, opt-in/opt-out, unsubscribe management.
- 3Control profiling. Information, framework for marketing profiling and recommendation.
- 4Secure the payment. Security of payment data and customer accounts.
- 5Qualify NIS2. Determining whether you are a targeted marketplace.
How Data Comply One supports the sector
Data Comply One covers GDPR, AI Act, NIS2 and DORA on a single platform, with outsourced DPO and CISO services, and supports e-commerce businesses on key areas of concern (cookies, prospecting, profiling) and, for marketplaces, on NIS2.
DCO offers tailored templates (cookie policy, register, direct marketing governance framework).
Frequently asked questions
Yes for non-essential trackers (advertising, non-exempt audience measurement): free, informed, and revocable consent is required.
Detailed guides by regulation
Where does your compliance stand?
Take stock in a few minutes or talk to an expert dedicated to your sector.
They already trust us
See how organisations in the e-commerce sector secured their compliance with DCO.