Every order your shop takes gives you a customer's name, address and email address, and you pass some of it to your supplier so they can send the parcel. The law expects you to look after those details, tell customers what you do with them, and only email them in the ways it allows.
This guide explains what that means for a small online shop. The rules are overseen by the Information Commissioner's Office, which gov.uk says is being replaced by a new Information Commission. Its website is still ico.org.uk.
The data protection fee
The ICO says organisations, including sole traders, that use personal information need to pay a data protection fee, unless they are exempt. For a business with a turnover of up to £632,000 or no more than ten staff, the fee is £52 a year, with £5 off if you pay by direct debit.
Some businesses don't have to pay, depending on what they use people's details for. The ICO has a short online check to tell you whether you need to pay, so use that rather than guessing.
A privacy notice on your website
Your website needs a privacy notice: a page telling customers who you are, what details you collect, why, who you share them with, how long you keep them, and what their rights are, including how to complain. For a dropshipping shop, "who you share them with" includes your supplier, your shop website and your payment company. The ICO has a free tool that helps you write one.
Since 2026, the law also says you must give people a way to complain to you about how you use their details, and acknowledge a complaint within 30 days.
Marketing emails
You can only send marketing emails to people who have agreed to get them, or who meet all the conditions of what the ICO calls the soft opt-in:
- you got their email address yourself, when they bought from you or asked about buying;
- you only email them about your own similar products;
- you gave them a simple way to say no when you took their address;
- and you give them a way to unsubscribe in every email you send.
The ICO says there is no such thing as a bought email list that meets the soft opt-in, and that an unsubscribe option hidden in your privacy policy doesn't count. Every marketing email must say who it is from and how to stop them.
How long to keep customers' details
The law doesn't set a time limit, but you must not keep personal details for longer than you need them. Decide how long you need order details for, for example to deal with returns and to keep your tax records, and delete them after that.
If something goes wrong
If customers' details are lost, stolen or seen by someone who shouldn't see them, that is a data breach. If it is serious enough to report, you must tell the ICO within 72 hours of finding out. If there is a high risk to your customers, you must tell them too, without delay. The ICO has a phone line for advice, on 0303 123 1113.
