An online shop processes its customers’ names, addresses, phone numbers, order and payment information. The General Data Protection Regulation (GDPR) requires that this data be protected against unauthorised processing, loss and damage (Article 5(1)(f) GDPR). Responsibility lies with whoever determines the purposes and means of the processing, that is, the controller (Article 4(7) and Article 24(1) GDPR), even if others built and maintain the website.
On 8 July 2026 the State Data Protection Inspectorate (VDAI) published a recommendation, “Aspects of ensuring personal data security on e-commerce websites”, dated 3 July 2026. Under the Lithuanian Law on the Legal Protection of Personal Data (ADTAĮ), VDAI supervises the application of the GDPR in Lithuania and performs the tasks of the supervisory authority set out in the GDPR (Article 7(1) and Article 11(1) ADTAĮ). It is one of the methodological recommendations VDAI prepares and publishes under Article 11(2)(1) ADTAĮ. In our assessment, it creates no new obligations: the obligations come from Article 32 GDPR, on which the recommendation builds. Below: what the GDPR itself requires, what VDAI adds, and what is at stake if customer data leaks.
What the GDPR requires
Security according to risk. The controller and the processor implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. Where appropriate, this includes encryption, the ability to ensure the confidentiality, integrity and availability of systems, the ability to restore the availability of and access to data in a timely manner after a physical or technical incident, and regular testing of the measures (Article 32(1) GDPR). What the article means in general is covered in GDPR security measures: what Article 32 really requires.
Only the data that is necessary. The controller must ensure that by default only the data necessary for each specific purpose is processed (Article 25(2) GDPR). In our assessment, this applies to the order form too: fields not needed to fulfil the order should not be mandatory.
Staff act on instructions. The controller and the processor take steps to ensure that a person acting under their authority who has access to the data does not process it except on the controller’s instructions (Article 32(4) GDPR).
Suppliers. Whoever processes personal data on behalf of the controller is a processor (Article 4(8) GDPR). The controller may use only processors providing sufficient guarantees to implement appropriate measures (Article 28(1) GDPR). The contract with the processor must stipulate that it takes all measures required under Article 32 (Article 28(3)(c) GDPR). Which supplier is a processor depends on who determines the purposes and means of the processing (Article 4(7) GDPR). In our assessment, a hosting provider or e-commerce platform that stores customer data on your behalf meets the definition of a processor. The role of a payment service provider or a plugin developer has to be assessed separately, by what it does with the data. When a written contract is required and what it must contain is covered in Data processing agreement: when it is required and what is at stake without one.
What VDAI recommends for online shops
The recommendation builds on Article 32 GDPR and identifies several risks specific to e-commerce. Quotations below are our translation from Lithuanian.
Third-party scripts and plugins. VDAI warns of “Magecart” attacks, “which inject malicious code into checkout pages through third-party scripts”. VDAI recommends that risk mitigation strategies include “supplier risk management, security (penetration) testing and continuous monitoring of external connections”. Whether scripts that set cookies need the visitor’s consent is covered in Cookies and consent banners: what the law requires.
Not only the website. VDAI notes that even where the online shop is well protected, attackers can “exploit a less protected mobile app or API and thereby reach personal data”. Therefore, according to VDAI, businesses need “coordinated and comprehensive protection measures that protect customer data at all touchpoints”.
Accounts and access. VDAI recommends introducing multi-factor authentication gradually, starting with higher-risk operations “such as administrator logins, payment approval or access to customer data”. According to VDAI, access rights management ensures that users are granted “only the rights necessary to perform their duties”.
Encryption. According to the recommendation, encrypting data at all stages means that “even if someone gained access to the data, only an unintelligible set of characters would be visible”. The GDPR itself names encryption as a possible measure (Article 32(1)(a) GDPR).
Updates and audits. VDAI writes that “regular security audits, staff training and technology updates are essential for e-commerce systems”. Among the measures to be applied “as appropriate”, the GDPR lists a process for regularly testing, assessing and evaluating the effectiveness of the measures (Article 32(1)(d) GDPR), and the controller’s measures are reviewed and updated where necessary (Article 24(1) GDPR).
Cloud. VDAI notes that one must understand “which security aspects the cloud provider is responsible for and which remain the responsibility of the organisation itself”. Under the model the recommendation describes, the organisation is usually left with “what happens in the systems hosted in the cloud and managed by the organisation”.
What can happen
If customer data leaks, the controller notifies VDAI without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to people’s rights and freedoms (Article 33(1) GDPR). Each supervisory authority is competent on the territory of its own Member State (Article 55(1) GDPR), so if the shop is established only in Lithuania, the competent supervisory authority is VDAI (Article 11(1) ADTAĮ). A processor that becomes aware of a breach notifies the controller without undue delay (Article 33(2) GDPR). Where the risk is high, the customers themselves must also be informed (Article 34(1) GDPR). This is not required if the data was protected by measures that make it unintelligible to anyone not authorised to access it, such as encryption (Article 34(3)(a) GDPR). The controller must document every breach, even one that is not notified (Article 33(5) GDPR). The VDAI recommendation adds: “It is important not to forget to document the decisions taken, the investigations carried out and the reports.” When and how to notify is covered in more detail in Personal data breach: when to notify VDAI and the people affected.
The second risk is a fine. For infringing the obligations under Articles 25 to 39, including the security and breach notification duties, the fine can reach up to ten million euros or, for an undertaking, up to two percent of its total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(4)(a) GDPR). Fines are imposed by the supervisory authority (Article 32(1) ADTAĮ). When deciding on a fine, it gives due regard also to the measures implemented under Articles 25 and 32 (Article 83(2)(d) GDPR).
The third risk is damage to customers. Anyone who has suffered material or non-material damage as a result of a GDPR infringement has the right to receive compensation from the controller or processor (Article 82(1) GDPR). The controller is exempt only if it proves that it is not in any way responsible for the event giving rise to the damage (Article 82(3) GDPR). In our assessment, where malicious code got in through a plugin that nobody updated or checked, proving this will be hard: the controller must implement measures appropriate to the risk and be able to demonstrate this, and those measures are reviewed and updated where necessary (Article 24(1) GDPR). The GDPR lists regular testing of the measures among them (Article 32(1)(d) GDPR).
When to call a lawyer
- when you suspect that foreign code ran on your checkout page and you must decide whether to notify VDAI within 72 hours and whether to inform customers without undue delay;
- when your platform, hosting or plugin supplier reports an incident on its side;
- when there are no contracts with suppliers, or it is unclear which of them is a processor;
- when VDAI asks you to show what security measures you apply;
- when a customer claims compensation for leaked data.
Frequently asked questions
Is the VDAI recommendation binding?
In our assessment, the recommendation itself is not. It is one of the methodological recommendations VDAI prepares and publishes (Article 11(2)(1) ADTAĮ). What is binding is the GDPR: the measures must be appropriate to the risk (Article 32(1) GDPR), and the controller must be able to demonstrate compliance (Article 5(2) GDPR). In our assessment, the recommendation shows which measures VDAI expects from an online shop, so it is worth keeping at hand when assessing risk.
Is the platform provider, not the shop, responsible for security?
Both are. The security duty applies to the controller and the processor alike (Article 32(1) GDPR). But the controller must choose a processor providing sufficient guarantees of appropriate measures (Article 28(1) GDPR), and a customer may claim compensation from the controller (Article 82(1) GDPR).
Do we need to notify VDAI if only email addresses leaked?
Notification is required unless the breach is unlikely to result in a risk to the rights and freedoms of people (Article 33(1) GDPR). The controller decides. It documents every breach, including the facts, its effects and the remedial action taken, so that VDAI can verify compliance with Article 33 from those records (Article 33(5) GDPR). In our assessment, this is why the reasons for not notifying are worth recording too.
How to start
List every supplier and tool that touches customer data: the platform, hosting, payments, delivery, plugins and scripts running on the website. Next to each, note whether there is a contract, who has administrator access and whether multi-factor authentication is switched on. Where there is no answer, contact us – we will assess the risk and prepare the missing documents.
You can check whether your organisation needs a record of processing activities with the Privacio tool, built by Linden (in Lithuanian).
Email: info@linden.lt
More about this service: GDPR audit, compliance documents and consultations.