RoPA for E-Commerce: 8 Typical Processing Activities

Main article: Creating a record of processing activities 2026 — the full pillar article on this topic.

The following eight processing activities are the typical entries in the day-to-day operation of an online shop — from incoming order to advertisement. Each item is written as an entry you can adopt directly: purpose, legal basis and retention period are stated in the first paragraph, together with data categories and recipients where they are relevant to the entry; below that you will find what the entry triggers and where the obligation comes from. The obligation to keep a record itself follows from Art. 30(1) GDPR, the legal bases from Art. 6(1) GDPR.

What each of the eight entries must contain

Every entry needs the same nine fields: eight mandatory fields from Art. 30(1)(a)–(g) GDPR plus the legal basis as a practical field. Art. 30(1) GDPR lists seven mandatory items; because (c) bundles two points (categories of data subjects and categories of personal data), practice derives eight mandatory fields from it. The ninth field is not contained in Art. 30(1), but follows from Accountability under Art. 5(2) GDPR.

1. Name and contact details of the Controller (and of the data protection officer, where applicable)
2. Purposes of the processing
3. Categories of data subjects
4. Categories of personal data
5. Categories of recipients
6. Transfers to a Third Country including safeguards
7. Envisaged time limits for erasure
8. General description of the technical and organisational measures (Art. 32 GDPR)
9. Legal basis (practical field)

Set these nine fields up as the columns of your RoPA spreadsheet — then each of the following eight entries can be transferred row by row. Three fields are filled in largely uniformly: field 3 (categories of data subjects) following the template in the main article with customers and prospective customers — for entries 4 and 8 you should additionally check which further visitor groups are covered; field 1 (Controller, and data protection officer where applicable) and field 8 (reference to the central technical and organisational measures concept) are defined once for the whole shop and adopted unchanged into every entry. The headings of the eight entries therefore name only those of the remaining fields that are relevant in each case.

The exemption in Art. 30(5) GDPR does not relieve a shop: it applies cumulatively only, and in a shop it already fails because the newsletter — like the ongoing processing of customer master data and CRM data — is regular processing. The four conditions in detail — including the distinction between 'a risk' and 'high risk' — are set out in the FAQ.

1. Order fulfilment

Purpose: performance of the contract. Legal basis: Art. 6(1)(b) GDPR. Data categories: master data, addresses, payment data, order data. Recipients: payment service providers, shipping service providers, tax advisers. Retention period: 6 or 10 years depending on the type of record (HGB/AO).

Processing is lawful if at least one of the conditions in Art. 6(1) GDPR is met — here (b), the scope of which is set out in the table 'Consent, contract, legitimate interests'. The recipients named belong in field 5 as categories; for every service provider that processes the data on your behalf, a contract under Art. 28(3) GDPR is required in addition. In Germany, the retention period follows commercial and tax law (6 years HGB, 10 years AO). Which period applies must be determined for each data category from the HGB and the AO and recorded in the entry — instead of a blanket period for the entire entry. At the same time, document the conflict between the retention obligation and the right to erasure under Art. 17 GDPR. For Austria, the UGB and the BAO apply — see the section 'Legal position in Austria'.

2. Customer account

Purpose: login + order history. Legal basis: Art. 6(1)(b). Data categories: login data, profile details. Recipients: shop system (Data Processor). Retention period: until the account is deleted + 12 months.

The customer account is a separate entry because it holds data beyond the individual order: login data and profile details exist independently of the specific contract. Field 8 should contain a reference to your central technical and organisational measures concept under Art. 32 GDPR — not the content of those measures itself; repeating the text of the measures in every entry appears on the list of mistakes in the main article (section '9 common mistakes to avoid'). Also record who handles requests for access, rectification and erasure arising from the account; the deadlines for this are set out in the section 'Currency and evidence'.

3. Newsletter

Purpose: marketing. Legal basis: Art. 6(1)(a) (consent). Data categories: email address, click behaviour. Recipients: newsletter providers (Brevo, Mailchimp). Retention period: until withdrawal + 3 years for evidence.

Consent places two additional burdens on the entry — evidence and withdrawal at any time; the content of the provision is set out in the table below. Practical recommendation: record for each address the time, the wording of the consent and its origin, and note the withdrawal route in the entry. For recipients in the EU, listing them by name is generally sufficient; if the newsletter provider is based in a Third Country, the transfer together with the safeguard belongs in field 6: SCC, DPF or BCR. Field 6 names the provider, country and safeguard — in the template in the main article, for example 'Mailchimp (USA, DPF)' — not merely 'Third Country yes'; the missing Third Country note for US tools is among the mistakes listed there. For Austria, § 174 TKG 2021 applies in addition (see below).

4. Cookies / tracking

Purpose: audience measurement, personalisation. Legal basis: § 25 TDDDG (Germany) + Art. 6(1)(a) GDPR; in Austria, § 165 TKG 2021 + Art. 6(1)(a) GDPR instead. Data categories: usage data. Recipients: tracking tools. Retention period: max. 12 months (practical value, not a statutory deadline).

In Germany, the entry rests on two provisions — § 25 TDDDG and Art. 6(1)(a) GDPR; what § 25(1) requires and when subsection 2 makes consent unnecessary is set out in the table below. In operational terms this means: in the entry, assign every cookie to one of the two exemptions in § 25(2) TDDDG — or provide evidence of consent under Art. 7(1) GDPR for all the others. Practical recommendation: document the lifetime of each cookie individually in the entry instead of giving a collective figure for the entry as a whole.

5. Product reviews

Purpose: marketing + quality feedback. Legal basis: Art. 6(1)(f) (legitimate interests). Data categories: pseudonym, review. Retention period: max. 5 years.

Unspecific collective entries — 'collective processing: communication' in the template — are among the mistakes listed there; the content of (f) is set out in the table below. Practical recommendation: record in the entry which interest is specifically meant — 'legitimate interests' on its own remains too unspecific. Attach a short note to the entry setting out your own interest, the identifiable countervailing interests of the reviewers and the outcome of your balancing exercise. In addition, separate in the 'purposes' field the publication of the review from the internal quality evaluation; the two may have different recipients and erasure periods, and separate purposes can be justified individually if a supervisory authority asks.

6. Shipment tracking

Purpose: performance of the contract + service. Legal basis: Art. 6(1)(b). Recipients: DHL, UPS, Hermes. Retention period: 6 months after delivery.

Before the entry can be finalised, clarify the role of the service provider: Data Processor (Art. 4 no. 8 GDPR), separate Controller (Art. 4 no. 7 GDPR) or joint controllership (Art. 26 GDPR)? Confusing processing on behalf of a controller with joint controllership is among the mistakes listed there and determines which contract you need. The 6 months after delivery belong in field 7 as a concrete erasure period — an entry stating 'no specific information' counts as a missing erasure period.

7. Returns management

Purpose: performance of the contract. Legal basis: Art. 6(1)(b) + (f). Data categories: order and payment data. Recipients: payment service providers, in so far as the refund is processed through them. Retention period: 10 years (tax); for returns data not relevant for tax purposes, the contract term plus the limitation period applies.

Here two legal bases stand side by side: (b) for unwinding the contract, (f) for the supplementary legitimate interest. Practical recommendation: name that interest specifically rather than in general terms — in the case of returns, for example the detection of abuse where returns behaviour is conspicuous — and record the reasoning with the entry. Keep returns as a separate entry rather than an appendix to order fulfilment: only then does it remain traceable which purpose rests on which basis, and only then can the two periods be shown separately — 10 years for the records relevant for tax purposes, and for the remaining returns data the contract term plus the limitation period. Also check whether the same payment service provider is a recipient for the refund as for the order; categories of recipients belong in field 5 even if they are already named in another entry.

8. Re-targeting / advertisements

Purpose: personalised advertising. Legal basis: Art. 6(1)(a). Data categories: usage data. Recipients: Google Ads, Meta Pixel. Retention period: 12 months.

Three follow-up checks attach to this entry. If information is stored on or read from the terminal equipment, § 25(1) TDDDG additionally applies in Germany. Secondly, you must check whether a data protection impact assessment is required: Art. 35 GDPR expressly names systematic and extensive evaluation of personal aspects (profiling) with legal effect as such a case. Practical recommendation: record the outcome of the check even where it is negative. Thirdly, this has a staffing consequence in Germany: if processing is subject to the obligation to carry out a data protection impact assessment under Art. 35 GDPR, a data protection officer must be designated irrespective of the number of employees (§ 38(1) sentence 2 of the German Federal Data Protection Act (BDSG)).

Consent, contract, legitimate interests: what the choice triggers

The legal basis determines which additional obligations attach to the entry — not merely whether the processing is permissible. In the following overview, the column 'In the shop' reflects the allocation used in this article; the column 'Content of the provision / what applies in addition' states the provision itself for contract and legitimate interests, and for consent and § 25 TDDDG the additional obligations attached to it.

Processing agreements: which shop service providers are covered

For every service provider that processes personal data on your behalf you need a data processing agreement — in a shop this may concern the shop system, payment providers, shipping service providers and tracking tools; for shipping service providers, clarify the role first (see section 6). Art. 28(1) GDPR permits cooperation only with processors that provide sufficient guarantees of appropriate technical and organisational measures. The contract under Art. 28(3) GDPR must set out the subject matter and duration of the processing, the nature and purpose, the type of personal data, the categories of data subjects and the obligations and rights of the Controller. Each of these service providers must at the same time appear in the RoPA as a category of recipients: outdated recipient lists — for example a newsletter tool that has been replaced — are, like missing erasure periods, among the typical RoPA mistakes (practical experience).

If, conversely, you process data on behalf of others, for example as a fulfilment service provider, keep a separate record for this under Art. 30(2) GDPR with four mandatory items: (a) the name and contact details of the Data Processor and of each Controller on whose behalf it acts, and where applicable of the representative and the data protection officer; (b) the categories of processing carried out on behalf of each Controller; (c) where applicable, transfers to a Third Country including the documentation of suitable safeguards; (d) where possible, a general description of the technical and organisational measures under Art. 32(1) GDPR. The providers and tools named in the eight entries are examples; what matters is your actual set of service providers.

Currency and evidence

The record must be made available to the supervisory authority on request (Art. 30(4) GDPR) — it must therefore reflect the current position at all times. Practical recommendation on frequency: a quarterly review plus immediate updating whenever something changes, and at minimum a full annual revision. This is a practical rhythm, not a statutory deadline. Record every update with a date and version; missing version control and a non-editable format (PDF instead of Excel/CSV) are among the mistakes listed there. In practice, the order in which supervisory authorities examine matters is: RoPA, then processing agreements, then the technical and organisational measures concept, then the data protection impact assessment. Where the record is requested, experience shows that supervisory authorities expect it to be provided within 1 to 2 weeks (experience value, not a statutory deadline). In addition to the retention periods of the entries, the following response obligations apply; all figures in the table are requirements from the text of the Regulation, not practical values:

Legal position in Austria

The legal bases named above under Art. 6(1) GDPR ((a) consent, (b) contract, (f) legitimate interests) apply identically in Austria — the GDPR is a directly applicable EU regulation. Only the national connecting points differ:

• RoPA content: Art. 30 GDPR applies word for word in Austria — the same mandatory items, no different thresholds or deadlines. The eight entries can therefore be adopted in their structure and fields; the German connecting points — retention periods under the HGB/AO and § 25 TDDDG — must be replaced by the Austrian ones named below.
• Cookies / tracking: § 25 TDDDG is German law (for its content see the table 'Consent, contract, legitimate interests'). In Austria, consent is governed by § 165(3) TKG 2021 (opt-in for tracking cookies). The standard for consent itself is the same in both countries, because information and consent must be provided in accordance with the GDPR (Art. 6(1)(a), Art. 7 GDPR).
• Newsletter: in addition to Art. 6(1)(a) GDPR, § 174 TKG 2021 (unsolicited messages) applies in Austria — consent is required; in practice it is documented by means of a double opt-in procedure.
• Supervision: Germany — the state data protection authorities for non-public bodies (§ 40(1) BDSG), the Federal Commissioner for Data Protection (BfDI) for federal bodies (§ 9(1) BDSG). Austria — the Austrian Data Protection Authority (Datenschutzbehörde, DSB) as the national supervisory authority (§ 18(1) DSG).
• Retention periods: the periods named above, '6 years HGB' and '10 years AO', follow German commercial and tax law. In Austria, the corresponding obligations arise from the Austrian Commercial Code (UGB) and the Austrian Federal Fiscal Code (BAO); the periods must be determined separately for an Austrian shop and recorded in the RoPA.
• Data secrecy: § 6 DSG obliges controllers, processors and their staff to maintain confidentiality. Where processing is carried out on behalf of a controller — including with a German service provider — this obligation applies alongside Art. 28 GDPR, for which there is no special rule in Austria.
• Data protection officer: a shop may be subject to the designation obligation in Germany under § 38(1) BDSG and not be so in Austria where no Art. 37 condition is met — assess both locations separately. Details in the FAQ.