Data Minimisation in Online Stores: What to Store at Checkout and in a User Account

Data minimisation in an online store: what is actually needed at checkout

The GDPR data minimisation principle means that personal data is collected only to the extent required by the purpose of the processing. In an online store, a good question is therefore: is this information needed specifically for processing the order?

A standard delivery order

Typically, at least the following are needed:

• the recipient's name
• the delivery address or pickup point
• contact details for delivery messages
• the information needed for invoicing/payment.

Not all of this information necessarily needs to be stored in a permanent user profile.

Guest checkout reduces unnecessary account creation

If a customer can place a one-off order without a permanent account, the online store does not need to force them to create a username just for a single purchase.

Mandatory and optional fields must be kept separate

If a date of birth, gender or other additional information is not needed to deliver the order, it should be possible to justify the purpose of the field. Information needed for marketing should not be disguised as mandatory delivery information.

The retention period is not the same for all data

Information related to invoicing may have to be retained for longer for statutory reasons than, for example, an abandoned shopping cart. The EDPB's GDPR principles also include storage limitation: data is not kept in an identifiable form for longer than the purpose requires.

The privacy notice should match the practice

The notice should state:

• what data is collected
• for what purpose
• the legal basis for the processing
• how long the data is retained
• to whom it is disclosed
• what rights the data subject has.

What customers can do themselves

On a shared device, do not save payment details or a password in the browser if others use the same profile. Also check which email address the order confirmation is sent to.

Source

European Data Protection Board: GDPR basic principles, in particular data minimisation and storage limitation.

Go through each field by its purpose

Data minimisation can be made concrete with a table:

Field	Typical purpose	Question
Name	identifying the recipient	is the full name needed?
Address	home delivery/invoicing	is it needed if pickup takes place from a parcel locker?
Phone	delivery messages	is SMS necessary?
Email	confirmation and receipt	is it also used for marketing on a separate basis?
Date of birth	rarely needed in a standard order	what purpose justifies collecting it?

The table does not resolve the legal basis on its own, but it forces the online store to explain why a field exists.

Marketing is separated from the order

Fulfilling an order and direct marketing are not the same processing purpose. Subscribing to a newsletter should not be hidden as a necessary condition of the order if there is no basis for it.

Minimising the customer account

The account does not need to display all possible data. Useful information may include, for example, order history and an address book, but old temporary data should not be kept in the user interface without a purpose.

Autofill can reveal more than the user expects

On a shared computer, the browser's autocomplete can show the name, address and email to the next user. From a privacy perspective, this is often a more practical risk than a complex technical threat model.

The retention period must be justifiable

The GDPR storage limitation principle means that personal data is not kept in an identifiable form for an unnecessarily long time. The statutory retention of invoicing-related data may be a different matter from, for example, the data of an unfinished checkout session.

Privacy by default

The EDPB emphasises data protection by design and by default. In practice, this means, for example, that optional data is not collected by default and that marketing choices are not set on the user's behalf without a basis.

Every piece of data at checkout should have a purpose

A name and delivery address are often needed to deliver a physical order. A date of birth, gender or other additional information, on the other hand, is not necessarily needed unless the service has a clear basis for collecting it.

The data minimisation principle means collecting only the information that is necessary for the purpose.

Mandatory and optional fields must be clearly separated

If information is needed only for marketing or personalisation, it should not be disguised as a mandatory part of the order. The user must understand which fields are necessary.

A good form is often shorter and clearer for precisely this reason.

Guest purchase reduces unnecessary account data

Not all customers need a permanent user account. Guest checkout can be a good option if the customer wants to make a single purchase without saving a password, favourites and order history to an account.

Information retained for legal or accounting reasons is a different matter from a user account.

Addresses saved in the account should be kept up to date

Old delivery addresses increase the risk of a misdelivery. Remove addresses you no longer use.

The same applies to old phone numbers and unnecessary profile information.

Marketing consent should not be hidden among the order

The choice of a newsletter or other direct marketing must be clear and separate. The customer should not have to accept marketing in order to have a standard order delivered, unless there is a specific legal basis for it.

Withdrawing consent must be easy.

Saving payment details is a separate decision

Card details are often processed through a payment service. The user should understand whether the payment method is saved for future purchases.

If you do not need the saving, do not choose it just for the sake of speed.

It should be possible to remove unnecessary data from the user account

A good service lets you manage addresses, payment methods, marketing settings and other profile information. However, the right to erasure does not mean that a company could delete data that it is required by law to retain for a certain period.

The privacy notice should describe these differences.

The retention period is as important as collection

Data should not be kept indefinitely without a purpose. The company must define retention periods or the criteria for determining them.

From the user's perspective, this shows whether the management of personal data has been thought through systematically.

A shared device requires special attention to autofill

Browser autofill can save an address, email and payment details. On a shared computer, it is worth using a separate user profile or turning off autofill for sensitive fields.

Logging out of an online store does not necessarily remove data saved in the browser.

Minimum-data checklist for checkout

Ask about each field: is this needed for delivery, payment, a legal obligation, or is it optional? If no purpose can be found, the necessity of the field should be questioned.

A shorter checkout is often both more private and more user-friendly.

Form design affects how much data is collected

A field that is displayed automatically tempts one to collect the data "just in case". A good checkout starts from the business need and adds only the fields that have a clear purpose.

A shorter form often also improves conversion.

The purpose of the phone number should be stated

If the number is needed for the carrier's pickup message, say so next to the field. The customer better understands why the information is mandatory.

If the number is also used for marketing, a separate appropriate basis is required.

In practice, a date of birth is a highly sensitive identifier

Although a date of birth is not the same thing as a personal identity code, collecting it unnecessarily increases the identifiability of a person. Do not ask for it unless the service has a genuine need, for example because of an age limit or the law.

"Improving the customer profile" alone is not a good default basis.

Address history should be cleaned from the user account

Keeping old addresses increases the risk of accidentally ordering to the wrong place. The user should be able to remove unnecessary addresses themselves.

Old order data retained in the background of the system because of the law is a different matter.

Data export and erasure requests make it easier for users to stay in control

GDPR rights include the possibility of requesting access to one's own data and, in certain situations, its erasure. An online store should make the request channel clear.

Not all data can be deleted immediately if the law requires it to be retained.

Minimisation should also extend to log data

Technical logs may contain IP addresses, identifiers and error information. The retention period and access rights should be proportionate to the actual security and diagnostic need.

Data minimisation does not concern only visible form fields.

Creating an account should not be used as an excuse for unnecessary profiling

A user account can make order history and addresses easier to manage, but it does not automatically justify collecting a date of birth, gender, interests or other additional information.

Every field must have a defined purpose and an appropriate legal basis for processing.

Analytics should be separated from the individual customer's profile

A business may need aggregated information about conversion or delivery countries without keeping each user's behavioural history in identifiable form for an unnecessarily long time.

Designing the data model can reduce the amount of personal data already at the technical level.

Identifiers of a deleted account must not be reused unnoticed for profiling

If a user closes an account, the system must separate the order history that must be retained by law from the active marketing profile. Using old identifiers to build a new profile requires its own legal basis.

The data requested at checkout should be justifiable by its purpose of use

An online store needs some information for order processing, payment and delivery, but not all fields need to be mandatory. A buyer should pay attention to which information is necessary and which mainly serves marketing or convenience. For example, a delivery address is needed for home delivery, but a separate date of birth or other additional information is not necessarily related to a standard purchase.

Data minimisation does not mean that an online store may not collect anything. It means that an appropriate amount is collected for the purpose and that the user is told what the data is used for.

Not everything should be saved to a user account just for speed

A saved address and payment method can speed up the next order, but at the same time they increase the amount of data left in the account. If the service is used rarely, it may make sense to delete old addresses and payment methods or to use guest checkout, if it is offered.

For account security, a unique password and possible multi-factor authentication are more important than how quickly the next checkout is completed. Convenience and data minimisation should be balanced according to your own frequency of use.

Address autofill should be checked

Browsers and phones can save names, addresses and payment details for autofill. This is convenient on your own device, but on a shared computer it can reveal more than the user intended. It is worth checking the autofill settings especially if more than one person uses the same device.

Deleting old addresses also reduces delivery errors. Often, data minimisation therefore improves both privacy and the practical quality of the order at the same time.

Marketing permission should be separated from order processing

Consent to a newsletter or personalised marketing is not the same thing as information needed to deliver an order. At checkout, the choices should be understandable, and permission given for marketing should not be mixed with mandatory delivery fields.

A buyer should read the checkboxes before accepting them and later check in the account settings which communications have been subscribed to. This way, fewer unnecessary data flows and messages accumulate.

Old data should be cleaned up regularly

Over the years, a user account can accumulate old delivery addresses, phone numbers and saved payment methods. Going through these once or twice a year is a simple way to reduce unnecessary data. At the same time, you notice if the account has an old address that could cause a delivery error.

Form data saved in the browser should also be checked. Data minimisation therefore does not concern only the online store's system, but the whole chain in which personal data related to purchasing remains.

Order history may have a justified purpose of use

Not all purchase history needs to be deleted immediately. Orders can be useful for warranty, complaint or product identification purposes. The essential thing is to understand what data is retained and why. If the account is no longer used, closing it may be a more sensible option than leaving a profile that has been unused for years active.

Look for practical answers in the privacy notice

A long privacy notice is easier to read when you first look for a few things: what data is collected, for what purpose, how long it is retained and to whom it may be disclosed. With these questions, you can quickly find the content of the document that is relevant to the buyer.

Guest checkout can reduce the amount of permanent data

If an online store offers the possibility of placing an order without a user account, it can be a good option for a customer who buys rarely. Guest checkout does not mean anonymous purchasing, because delivery and payment still require the necessary information, but a separate permanent profile is not necessarily created.

Close an account only after open matters have been handled

If the account has an unfinished order, return or warranty matter, the login credentials and order history may still be useful. It makes more sense to delete a user account only once all open matters have been concluded and the necessary receipts have been saved.

Minimising personal data also reduces practical errors

An old phone number or a wrong delivery address is not only a data protection issue. It can lead to a failed delivery or to a message ending up with the wrong person. Regularly checking your data therefore improves both privacy and the smoothness of purchasing.

Sharing data with different services should be understood as a whole

In addition to the online store, data may be processed by a payment service, a carrier and technical service providers. A buyer does not need to know all the systems, but it is useful to understand that checkout is not one single data repository. The privacy notice usually explains for what kinds of purposes data is disclosed or processed.

Unnecessary profiles should be identified

If several user accounts with different email addresses have been created at the same online store over the years, data may be scattered across several profiles. Identifying and closing old accounts reduces both the amount of data and the risk of forgetting an active account altogether.

Keeping contact details up to date is part of data minimisation

Minimisation does not mean only deletion. Correcting incorrect or outdated data is also important. An up-to-date phone number and email address ensure that delivery and security messages go to the right person.

Order messages do not need to be kept indefinitely

Once the order has been delivered, any returns have been processed and the necessary receipts have been saved, old tracking messages can be deleted. This way, unnecessary purchase history that is no longer used for anything does not accumulate in the email for years.

A small annual data check is enough for most people

Data minimisation does not need to become a continuous project. One calm check per year may be enough: remove old addresses, remove unnecessary payment methods, close unused accounts and set marketing preferences according to your own needs.