You hold personal data about every customer.
WHAT YOU HOLD
Names, addresses, phone numbers, email addresses, order history. Possibly more depending on what you collect.
PRACTICAL OBLIGATIONS
Collect only what you need. Remove checkout fields you do not act on.
Protect access: strong passwords, two-factor authentication, and administrator accounts only for those who need them.
Delete old data you no longer need. WooCommerce has retention settings under Settings > Accounts & Privacy. Publish a privacy notice saying what you collect, why, and how long you keep it.
NEVER STORE CARD DETAILS
There is no legitimate reason for a WooCommerce shop to store card numbers. Use a hosted gateway. If any plugin offers to store card details on your server, do not use it.
EXPORTED DATA
Customer exports downloaded as CSV files must not sit in a publicly reachable folder. Anyone who guesses the URL can download your entire customer list.
IF THERE IS A BREACH
Contain it, assess what was exposed, open a ticket with us, take advice on notification obligations under the NDPR, and tell affected customers honestly.
