Rules and ethics
Part of Mapping UK conversion rules to each store decision with separate review gates
Ecommerce conversion data protection: checkout map
A practical ecommerce conversion data protection guide to mapping checkout events, purposes and roles, then checking PECR and UK GDPR before launch.
Ecommerce conversion data protection starts with separating checkout operations, not approving conversion tracking as one undivided feature. A tag reading a device, an order record, a customer profile, a marketing audience and an experiment allocation are separate operations. Each needs a purpose, role, data and retention decision. This guide sets out a mapping process, not a lawful-basis conclusion for a store.
What to take away
- Treat each tag, order record, profile, audience and experiment allocation as a separate operation with its own purpose and retention decision.
- A vendor configuration or analytics label does not qualify as a PECR exception; exceptions are tied to defined purposes and conditions.
- Record the actual decision-making arrangement to identify controllers, joint controllers and processors rather than relying on contract labels.
- Refusal of optional access is a valid customer state and must stay separate from script failure, blocked technology and identity loss.
- Privacy, PECR, data-protection officer and security reviewers should issue separate dated decisions before release.
Inventory the operation before choosing permission
List every cookie, pixel, script, software development kit, local-storage item, server event, identifier match and imported record. For each operation, record what is stored or read, its purpose, who decides, the people affected, recipients, location, retention, access, deletion and reviewer. Include suppressed or refused states, not just successful collection.
Example checkout map
- Payment step (for example, Stripe):map payment submission and result, the data involved, the parties’ actual roles, the applicable retention schedule, and the payment, privacy and security reviewers.
- Order-confirmation page (for example, a Google Analytics purchase event):map the conversion event and any order identifier, the parties’ roles, retention, and the analytics and CRO reviewers.
- Abandoned-basket flow (for example, Klaviyo):map the basket and contact data, the purpose and recipients, retention, and the privacy and marketing reviewers.
- A/B allocation and outcome (for example, Optimizely):map the assignment identifier and measured outcome, roles, retention, and the experimentation and privacy reviewers.
These are examples to check, not assumptions or endorsements. Verify the store’s actual setup and complete each row before selecting a lawful basis.
PECR regulation 6 governs storing information on, or accessing information from, a user’s device. It requires consent unless an exception applies: the sole purpose is carrying out a transmission, or the storage or access is strictly necessary to provide an information society service explicitly requested by the subscriber or user. Convenience, analytics labels and vendor settings do not establish necessity. See the ICO (Information Commissioner's Office) guidance on storage and access technologies; consider PECR and data-protection law separately.
Assign the real data roles
Use the actual decision-making arrangement to identify controllers, joint controllers and processors. The ICO's controllers and processors guidance hub explains the roles and responsibilities. A contract label is evidence to inspect, not a way to override what the parties do.
For each purpose, record the proposed lawful basis, necessity assessment, fairness effects, information given to people and route for rights. Keep order fulfilment, fraud controls, measurement, personalisation, research and marketing distinct. Do not reuse a service record for promotion merely because it is technically available.
If a supplier processes on instructions, Article 28 UK GDPR requires a written contract covering the subject matter, duration, type of data, people affected, instructions, confidentiality, security, subprocessors, rights assistance, deletion or return and audit evidence. The ICO's controller-processor contracts guidance can help check those terms.
Record the 2025 Act accurately
The Data (Use and Access) Act 2025 amends rather than replaces the UK GDPR, Data Protection Act 2018 and PECR. It introduces recognised legitimate interests for specified processing and requires controllers to facilitate data-protection complaints made directly to them. Consider whether these provisions apply to the operation; they do not automatically provide a basis for checkout analytics or marketing.
The ICO's direct marketing guidance covers another boundary. An abandoned-basket email or text is direct marketing and needs separate PECR and data-protection analysis. The PECR soft opt-in can apply to a business's own similar products or services when contact details were obtained during a sale or negotiations for a sale, and the customer had a clear chance to refuse at collection and in each message. Otherwise, valid PECR consent is generally needed. Keep service messages separate from promotions.
Design for missingness, rights and failure
Refusal of optional access is a valid customer state, not defective data. Keep it separate from script failure, blocked technology and identity loss. Do not degrade the checkout because someone declined optional measurement. For CRO, define the conversion event, denominator and experiment assignment; report measurement coverage and apply inclusion rules consistently. Missing tracking is not proof of no conversion, and consent-related gaps should not be mistaken for test lift or failure. Explain material consequences clearly without steering the choice.
Set owners for access, correction, objection, erasure, restriction and export requests. Define retention by purpose and ensure deletion reaches relevant processors and backups under an approved schedule. Log access, configuration and data-definition changes.
The NCSC's secure online service guidance covers identity, access, monitoring, supplier risk and incident planning. Translate this into risk-based controls and tested recovery evidence. It does not certify that an operation meets data-protection law.
Screen each operation for a data protection impact assessment (DPIA); UK GDPR Article 35 requires one before processing likely to result in high risk to people. Controllers should also check and meet the ICO data-protection fee obligation unless exempt under the Data Protection (Charges and Information) Regulations 2018. Before release, the privacy and PECR lawyer, data-protection officer and security reviewer should issue separate dated decisions. The consumer and accessibility reviewers should check whether notices and choices work in the full journey. Unknown roles, unexplained reuse, untested deletion or unresolved device access means hold.
Before you act
- Map the payment step, order-confirmation event, abandoned-basket flow and experiment allocation separately.
- Record purpose, data, actual roles, recipients, retention, access, deletion and reviewers for each operation.
- Select and justify a UK GDPR Article 6 basis per purpose; record consent where relied on.
- Check PECR regulation 6 for device access and the soft opt-in conditions for marketing.
- Screen for a DPIA, check the ICO fee obligation, and set out rights and information routes.
- Define conversion and experiment measurement rules; hold release if roles, reuse, deletion or device access remain unresolved.
Common questions
What does the ICO storage and access technology guidance say about exceptions?
PECR regulation 6 requires consent for storing or accessing information on a user’s device unless the sole purpose is carrying out a transmission or the storage or access is strictly necessary to provide an information society service explicitly requested by the user. Necessity depends on the specific operation; an analytics label, server-side route or vendor setting is not itself an exception.
How should a store treat a customer who refuses optional access?
Refusal of optional access is a valid customer state, not defective data. Keep it separate from script failure, blocked technology and identity loss. Do not degrade the checkout because someone declined optional measurement, and explain material consequences in clear language without steering the choice.
What did the ICO say about the Data (Use and Access) Act 2025?
The Data (Use and Access) Act 2025 amends rather than replaces the UK GDPR, Data Protection Act 2018 and PECR. It introduces recognised legitimate interests for specified processing and requires controllers to facilitate data-protection complaints made directly to them. Check whether those provisions apply to the operation rather than assuming they settle its lawful basis.
