GDPR and PCI-DSS for Online Businesses: A Practical Checklist

If you sell online to customers in the European Union, or you accept card payments, two sets of rules affect you: GDPR for personal data and PCI-DSS for payment card data. They can sound intimidating, but the basics are practical. This article is a general overview, not legal advice, so always confirm your obligations with a qualified adviser.

GDPR basics

• Know what you collect. List the personal data you hold, why you collect it and where it is stored.
• Have a lawful reason. Consent, a contract or a legitimate interest, and record which one applies.
• Ask for consent properly. Clear wording, no pre-ticked boxes, and an easy way to withdraw. This includes cookies and marketing emails.
• Be transparent. A privacy policy in plain language that says what you do with the data.
• Respect people’s rights. Be ready to provide, correct or delete a person’s data when they ask.
• Keep data only as long as needed. Delete what you no longer need.
• Report breaches. Have a plan so you can act quickly if something goes wrong.

PCI-DSS basics

PCI-DSS is the security standard for businesses that handle card payments. The simplest way to reduce your burden is not to touch card data at all: use a trusted payment provider so card details never pass through your own servers. Beyond that, the common requirements include:

1. Keeping systems and software updated and patched.
2. Using strong passwords and multi-factor authentication for anyone with access.
3. Restricting access to only the people who need it.
4. Encrypting data in transit and, where stored, at rest.
5. Logging and monitoring access, and reviewing the logs.
6. Testing your security regularly.

Security habits that help with both

Many controls serve both sets of rules: multi-factor authentication, role-based access, encryption, regular updates, backups and a written incident-response plan. Building these into your software from the start is far cheaper than adding them later.

Build compliance into the system

KURA CORP provides identity and access management, MFA, KYC/AML processes and PCI-DSS and GDPR compliant engineering, plus security audits and architecture reviews. We build systems that follow these practices; certification of your own business remains your responsibility and that of your auditor. See our services or book a free demo or get in touch.

A 10-minute self-check

1. Do you have a privacy policy that matches what you really do?
2. Do you know every tool that receives your customers’ data (shop, email, analytics, support)?
3. Do cookie banners and email sign-ups ask for consent clearly?
4. Can you find and delete one customer’s data if asked?
5. Do card details ever pass through your own server?
6. Is multi-factor authentication on for admin and email accounts?
7. Are your software, plugins and server updated?
8. Do you have backups, and have you tested restoring one?
9. Who can access customer data, and is that list current?
10. Do you know what to do in the first hour of a data breach?

Common mistakes

• Copying a policy from another site that does not describe your own practices.
• Collecting more data than needed “just in case”.
• Sharing admin logins instead of giving each person their own account.
• Leaving old plugins, test sites and former staff accounts active.
• Storing exports of customer data in unprotected folders or email.

When to involve a specialist

Bring in a lawyer for the interpretation of rules and for contracts, and an auditor where PCI-DSS or other certification applies. Bring in engineers to build the technical controls: access management, encryption, logging and secure development.