UK GDPR, PECR and the Data (Use and Access) Act: what UK online shops have to get right in 2026, what breaches cost, and a 12-point checklist for Shopware and Shopify.
UK online shops are governed by three sets of rules: UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), all enforced by the Information Commissioner’s Office (ICO). Most mistakes happen in three places: cookies and tracking pixels, email marketing consent, and contracts with tech suppliers.
Since 5 February 2026, the maximum fine for breaching PECR (for example, setting advertising cookies without consent) has risen to UK GDPR levels: up to £17.5 million or 4% of global annual turnover. At the same time, the Data (Use and Access) Act 2025 relaxed consent for some low-risk cookies, such as statistical (analytics) cookies, provided visitors get clear information and a simple way to opt out.
If you get consent right for advertising cookies and pixels, only email people who have opted in (or fall under the soft opt-in), and have proper contracts with every supplier that touches customer data, you cover most of the risk. The checklist in this article walks you through the twelve most important points.
This article is for UK merchants who want their online shop set up correctly without becoming lawyers. You will learn which rules apply in 2026, what changed with the Data (Use and Access) Act, what the ICO is actually enforcing, and how to put it into practice in Shopware 6 and Shopify. If you also sell to customers in the EU, you will find a short section on what that adds.
I am a TÜV-certified data protection officer (a European certification focused on GDPR) and I handle privacy and compliance topics in solution25’s e-commerce projects. Everything UK-specific in this article is based on official sources, mainly the ICO and legislation.gov.uk, all listed at the end. This article is general information, not legal advice. For decisions about your specific business, talk to a UK data protection solicitor.
An online shop handles personal data almost everywhere: on page views, in the basket, at checkout, in email marketing and in customer accounts. In the UK, the rules apply as soon as you process personal data of people in the UK, regardless of the size of your business.
| Area | What is required | Legal basis | Risk if you get it wrong |
|---|---|---|---|
| Cookies and tracking | Prior consent for advertising and other non-essential cookies; information and a simple opt-out for exempt statistical cookies | PECR (as amended by the Data (Use and Access) Act 2025) | ICO enforcement, fines up to £17.5 million or 4% of turnover |
| Privacy notice | Complete, current, explains purposes, lawful bases and individuals’ rights | UK GDPR Articles 13 and 14 | ICO action, complaints |
| Email marketing | Consent or soft opt-in for individuals, a working unsubscribe in every message | PECR regulation 22 | ICO fines, now up to UK GDPR levels |
| Suppliers | Written data processing agreement with every processor, safeguards for transfers outside the UK | UK GDPR Articles 28 and 44 to 49 | Fines |
| Individual rights | Respond to access, erasure and rectification requests within one month | UK GDPR Articles 12 to 22 | Complaints, ICO action |
| Data security | Appropriate security, report notifiable breaches to the ICO within 72 hours | UK GDPR Articles 32 and 33 | Fines, claims for damages |
| Data protection fee | Most businesses that process personal data must pay an annual fee to the ICO | Data Protection (Charges and Information) Regulations 2018 | Penalty for non-payment |
Unlike in the US, the UK works on an opt-in model for cookies. Advertising cookies, retargeting pixels and most third-party tracking need the visitor’s consent before they run. Since 5 February 2026, the Data (Use and Access) Act has exempted some low-risk cookies from consent, including statistical cookies used to improve your own website, but only if visitors get clear information and a free, simple way to object. Advertising cookies are not covered by the exemption.
In 2025 the ICO reviewed cookie compliance across the UK’s top 1,000 websites. By December 2025 it reported that 979 of them met its checks at the most recent test, 564 of those only after the ICO had contacted them. Smaller shops are not exempt: the same rules apply, and higher PECR fines since February 2026 raise the stakes.
Practical tip: Open your shop in a private window with developer tools open, reject all cookies, and check which marketing and analytics requests still go out. If your ad pixels fire as usual, you have work to do.
UK data protection law applies to any business processing personal data of people in the UK, whatever its size. There are no revenue thresholds as in many US state laws. What changes with size is mainly the ICO data protection fee and how much documentation is proportionate.
| Rule | Applies to | What it means for your shop |
|---|---|---|
| UK GDPR and Data Protection Act 2018 | All processing of personal data of people in the UK | Lawful basis, privacy notice, individual rights, security, processor contracts |
| PECR | Cookies and similar technologies, email and SMS marketing | Consent for non-essential cookies (with the new DUAA exemptions), consent or soft opt-in for marketing |
| Data (Use and Access) Act 2025 | Amends the rules above | Cookie exemptions and higher PECR fines since 5 February 2026, a right to complain directly to you since 19 June 2026 |
| ICO data protection fee | Most organisations processing personal data | Annual fee by tier; since February 2025 it is £52, £78 or £3,763 |
| Children’s code | Online services likely to be accessed by under-18s | Privacy by default and age-appropriate design if children use your shop |
The fee amounts are the ICO’s figures as of February 2025; check the ICO website for the current rates. Since 19 June 2026, customers can also complain to you directly about how you use their data, and you must acknowledge complaints within 30 days, so make sure someone owns that inbox.
According to the European Commission, the EU GDPR applies to companies outside the EU when they offer goods or services to people in the EU or monitor their behaviour there. Since Brexit, that includes UK businesses. If you actively market and ship to EU customers, plan for two things: EU cookie and marketing rules, which are in some respects stricter than the amended UK rules, and in most cases an EU representative under Article 27 GDPR. Many merchants run region-specific settings: UK rules for UK visitors, EU rules for EU visitors.
Tracking is not banned in the UK, but it needs the right legal footing. When Meta, Google, TikTok or another ad platform receives data from your shop to target people across other sites, the cookies and pixels involved need prior consent under PECR, and the onward use of the data needs a lawful basis under UK GDPR. Your privacy notice has to name these tools and explain what happens to the data.
Analytics is where the Data (Use and Access) Act brought some relief. Statistical cookies used to understand and improve your own website no longer need consent, provided visitors are clearly informed and can object easily. That exemption does not cover advertising or cross-site profiling, so many analytics setups that share data with ad networks still need consent. Be extra careful with sensitive data: if you sell products that reveal health conditions or other special category data, check what your pixels transmit, such as product names or category URLs. Simple wins: list every tool in your privacy notice, connect your tags to your consent status, and consider server-side tagging so you control exactly what leaves your shop.
For marketing emails and texts to individuals, PECR requires prior consent. The main exception is the soft opt-in: you may email existing customers about your own similar products and services if they were given a simple way to opt out when you collected their details and in every message you send. Every marketing email must identify you as the sender and include a working unsubscribe. Emails to corporate subscribers (for example name@company.co.uk) do not need consent, but they still need to identify you and offer an opt-out; sole traders and some partnerships are treated as individuals.
Two practical notes: First, a confirmed opt-in (double opt-in) is still smart, because it keeps your list clean and gives you proof of consent. Second, since 5 February 2026 the ICO can fine PECR breaches at the same level as UK GDPR breaches, so a careless newsletter import is no longer a minor risk.
Your shop does not run alone. Your host, payment provider, email platform, fulfilment partner, review app and support software all handle customer data. Under Article 28 UK GDPR, every supplier that processes personal data on your behalf needs a written contract with specific data protection terms. The large platforms usually include a data processing agreement in their terms or account settings. Someone just has to check it, accept it where needed, and file it.
Also check where your data goes. Transfers from the UK to the EU and EEA are covered by UK adequacy regulations. For transfers to the US, the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”) can be used if the US company is certified; otherwise you need the ICO’s International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Keep a simple data inventory as well: which tool gets which data, for what purpose, under which contract and in which country. It sounds like paperwork, but it is the table every privacy audit starts with.
For what a solid hosting setup looks like, see our article on Shopware Hosting 2026.
Under UK GDPR, customers can ask for a copy of their data, have it corrected or erased, object to direct marketing and more. You must respond without undue delay and at the latest within one month. For complex or numerous requests, you can extend this by up to two further months if you tell the customer within the first month. Objections to direct marketing must always be honoured. A short, informal email can be a valid request, so decide internally who answers them and how you confirm identity for access and erasure requests. The ICO’s guidance has long said, and the Data (Use and Access) Act now confirms, that your searches for an access request only need to be reasonable and proportionate.
Erasure has limits. Records you have to keep, for example for tax or accounting, can generally stay, but marketing data, tracking profiles and inactive accounts need a retention schedule with clear deadlines. And do not forget job applicants and staff: they have the same rights as your customers.
Both platforms bring much of what you need. It just has to be configured properly for UK rules. These are the points we check in every project:
UK privacy enforcement is real. Under UK GDPR, the ICO can fine up to £17.5 million or 4% of global annual turnover, whichever is higher, for the most serious breaches, and up to £8.7 million or 2% for others. Since 5 February 2026, the same maximum applies to PECR breaches such as unlawful cookies or marketing emails without consent; previously PECR fines were capped at £500,000.
| Breach | Maximum penalty | Typical trigger |
|---|---|---|
| UK GDPR, higher tier | £17.5 million or 4% of global turnover | Unlawful processing, ignoring individuals’ rights |
| UK GDPR, standard tier | £8.7 million or 2% of global turnover | Missing processor contracts, poor security, late breach reports |
| PECR (since 5 February 2026) | £17.5 million or 4% of global turnover | Advertising cookies without consent, marketing emails without consent |
| Data protection fee not paid | Fixed penalty set by regulation | No fee paid to the ICO |
For smaller shops, the realistic risk is less a record fine and more a customer complaint, an ICO enquiry, a reprimand or a claim for damages after a data breach. The problems behind them are almost always the ones in this article.
Yes, in almost all cases. Under PECR, advertising cookies and most third-party tracking need prior consent. Since 5 February 2026, strictly necessary cookies and certain low-risk cookies, such as statistical cookies used to improve your own site, are exempt from consent, but you still have to inform visitors and, for statistical cookies, offer a simple opt-out.
For online shops, three changes stand out: some low-risk cookies no longer need consent (since 5 February 2026), PECR fines have risen to UK GDPR levels of up to £17.5 million or 4% of global turnover (also since 5 February 2026), and individuals can complain directly to you, with complaints to be acknowledged within 30 days (since 19 June 2026).
Most businesses that process personal data electronically must pay it, with some exemptions. Since 17 February 2025 the fee is £52 for micro organisations, £78 for small and medium organisations and £3,763 for large organisations. Check the ICO website for the current tiers and exemptions.
Under UK GDPR, fines can reach £17.5 million or 4% of global annual turnover for the most serious breaches and £8.7 million or 2% for others. Since 5 February 2026, PECR breaches such as unlawful cookies or marketing emails without consent can be fined at the same level. For small shops, complaints, ICO enquiries and claims after a data breach are the more common consequences.
For individuals, yes, unless the soft opt-in applies: existing customers, similar products and services, and a clear chance to opt out at the point of collection and in every message. Emails to corporate addresses do not need consent but must identify you and offer an opt-out.
If children under 18 are likely to use your shop, the ICO’s Children’s code (Age Appropriate Design Code) applies. It requires high privacy settings by default, minimal data collection and no nudging towards weaker privacy choices.
It can. According to the European Commission, the EU GDPR applies to companies outside the EU that offer goods or services to people in the EU or monitor their behaviour. Since Brexit, that includes UK businesses that actively target EU customers. In most cases you will also need an EU representative under Article 27 GDPR.
Without undue delay and at the latest within one month. For complex or numerous requests, you can extend the deadline by up to two further months if you tell the customer within the first month. Objections to direct marketing must always be honoured.
We review your shop’s cookie consent, tracking, email marketing setup, checkout and supplier contracts and show you where action is needed. As a Shopware and Shopify agency that works with merchants across the UK, we implement the fixes too, from consent configuration to data deletion workflows. This is a technical review, not legal advice.
Henrik Schäfer is a TÜV-certified data protection officer and handles privacy and compliance topics in e-commerce projects at solution25. He helps merchants put privacy requirements into practice without losing sight of conversion. Get in touch
Last updated: November 2026. Next content review: February 2027. This article is general information and not legal advice.
