4.9
GDPR compliance services for online stores
scandiweb audits where your store collects and shares personal data, then fixes the gaps in your consent flows and tracking setup at code level.
Trusted by 700+ leading brands worldwide
Trusted by 700+ leading brands worldwide
Where GDPR compliance usually breaks
Most stores pass a surface check and fail underneath. The consent banner loads after the tracking it is meant to gate. Customer records sit in third-party tools nobody has mapped. A supervisory authority finds both in the first hour of looking.
Consent that does not gate anything
Your banner appears, the visitor clicks reject, and the tags fire anyway because they load before the consent state is read. The banner is decoration.
Data in tools nobody mapped
Personal data reaches analytics, support and marketing platforms through integrations added years ago. No record exists of what each one receives or where it stores it.
No answer for a data request
A customer asks for their data or its deletion. Finding every copy across your platform and connected systems takes weeks, and the deadline is one month.
What GDPR compliance work covers
Compliance on an online store splits into two halves. There are the documents that state what you do with personal data, and there is the code that decides what actually happens to it. scandiweb handles both, and treats the second as the half that fails audits.
Data flow audit
We map every point where your store collects personal data and every system it reaches, from checkout through to the marketing tools connected to it.
Consent architecture
Your consent banner is rebuilt so that tag firing depends on the consent state, and a rejected category stays rejected for the whole session.
Cookie and tag governance
Every tag gets an owner, a purpose and a consent category. Tags that nobody can justify come off the site.
Privacy notices and policies
Privacy policy and cookie policy are rewritten to match what your systems actually do, in language a customer can follow.
Subject access requests
We build the process and the queries that let your team find, export or delete one customer's data inside the one-month deadline.
Processor review
Each third-party service handling your customer data is checked for a processing agreement and a documented retention period.
Server-side tracking
Tracking is rebuilt to send data through your own server, so you decide what reaches each platform and what stays behind.
Ongoing monitoring
Regulations change and so do your integrations. We re-check consent behavior and data flows on a schedule you set.
Not sure where your store stands?
Compliance work that reaches the code
A legal opinion tells you what the regulation requires. It does not change what your checkout sends to a third-party pixel. scandiweb covers both levels, because the gap and the fix sit in different places. One is a document. The other is your tag manager and your integration layer.
On one project, rebuilding tracking to pass through the client's own server cut missing order data from around 15% to around 5%. The same change gave the client a single place to decide what each platform receives. That work is described in our GDPR compliance case study.
The same approach applies to how your store captures data in the first place. See data collection and storage and server-side tracking.
Work done by a team that has built eCommerce since 2003
%20(1).png)
Certified for security and quality management
scandiweb is ISO 9001, ISO 27001 and ISO 27017 certified, and PCI DSS compliant. Those cover quality management, information security, cloud services security and payment card data. On a data protection project this matters for a specific reason. Your obligations extend to every processor you work with, and that includes us.
Why companies choose scandiweb for compliance work
Data protection work reaches your storefront and every system connected to it. The group of agencies that can change both is smaller than the group that can write you a policy.
23+ years in eCommerce
scandiweb has built and supported online stores since 2003, across the platforms and integration patterns that data protection questions usually turn on.
ISO certified delivery
ISO 9001, ISO 27001 and ISO 27017 certified, and PCI DSS compliant, so the team handling your customer data works inside an audited security program.
600+ in-house engineers
Findings get fixed by the same organization that found them. A 0.4% hire rate keeps that group small and senior.
One accountable Delivery Manager
A single named person owns the scope and the reporting, so you are not coordinating between a legal advisor and a separate development team.
95 NPS across clients
Clients score the working relationship, and that score is why most compliance projects continue as longer support arrangements.
GDPR and CCPA frameworks in delivery
Data protection requirements are already part of how scandiweb scopes analytics and integration work for every client, before compliance is the stated goal.
How a compliance project works
The order matters more than the speed. Mapping your data before touching consent logic means you fix what is actually broken, and the evidence collected on the way is what you show an auditor later.
Data flow discovery
We inventory every system that touches personal data, from your platform and its integrations through to the tags loading in a customer's browser.
Regulation mapping
Your markets, customer base and processing activities decide which obligations apply. The set is different for a store selling only inside the EU and one shipping worldwide.
Gap identification
Each finding is written with the evidence behind it and the risk it carries, so you can decide what gets fixed first and what can wait.
Implementation and fixes
Consent logic, tracking, policies and processor agreements are corrected. Development work happens in your own repository, and you keep everything we build.
Ongoing monitoring
Your integrations change after launch. We re-check consent behavior and data flows on an agreed schedule. Related work is covered under eCommerce analytics services.
%20(1).png)
What clients say about working with scandiweb
.webp)
.png)
Frequently asked questions
How much does GDPR compliance cost?
Cost depends on how many systems hold personal data and how much of your tracking has to be rebuilt. A store on one platform with a handful of integrations is a different scope from a group running several storefronts. scandiweb prices the review first, so you see the gap list and the effort behind each fix before committing to the work.
How do I get my store GDPR compliant?
Start by mapping where personal data enters your store and every system it reaches. Then check that consent controls what actually fires, that each third-party processor has an agreement and a retention period, and that your team can answer a data request inside one month. Fix what the map exposes, then re-check after your integrations change.
Does GDPR apply to customers who are US citizens?
GDPR protects people in the EU, not EU citizens specifically. A US citizen living in or visiting the EU is covered while they are there. An EU citizen living in the US is generally not. In practice most stores apply one standard to everyone, because splitting behavior by location adds more risk than it removes.
Is there such a thing as GDPR certification?
There is no official GDPR certificate that a business can buy and display. Approved certification schemes exist under Article 42 but adoption is limited. What auditors and enterprise buyers accept is evidence: a data inventory, records of processing, processor agreements, and a security program backed by an established standard such as ISO 27001.
How is scandiweb different from a law firm?
A law firm reads your setup and tells you what the regulation requires. scandiweb does that and then changes the code, because most findings on an online store are engineering problems wearing legal clothes. Consent that does not gate tags, or data reaching a processor nobody documented, gets fixed in your repository.
What exactly is GDPR compliance?
GDPR compliance means you can show that every piece of personal data your business holds was collected on a lawful basis, is used only for the stated purpose, is kept no longer than needed, and can be found, exported or deleted on request. For an online store, most of that is decided by how the site and its integrations are built.
Is GDPR compliance mandatory for US companies?
Yes, if you offer goods or services to people in the EU or monitor their behavior. A US-registered company shipping to EU customers, or tracking EU visitors with analytics and advertising tags, falls inside the regulation. Registration location does not decide it. Where your customers are, and what you do with their data, decides it.
What are the seven GDPR principles?
Lawfulness, fairness and transparency. Purpose limitation. Data minimization. Accuracy. Storage limitation. Integrity and confidentiality. Accountability. The last one carries the most weight in an audit, because it means you have to prove the other six with records. An assertion does not count.
How long does a compliance project take?
The review and gap list typically take two to four weeks depending on how many systems are in scope. Implementation takes a few weeks for a single storefront with contained tracking. Where consent logic and integrations have to be rebuilt across several markets, it takes months. The review tells you which case you are in.
What happens after the compliance review?
You receive the data map, the gap list with the evidence behind each finding, and an effort estimate per fix. From there you can hand it to your own team, ask scandiweb to implement all of it, or pick the highest-risk items. There is no obligation to continue, and the documentation is yours either way.
Book a GDPR compliance review
Tell us what your store is built on and what triggered the question. We come back with what a review would cover and what it would take.
Prefer to talk now? Book a call straight away, or email us at: [email protected]
Related services
Not sure whether your store would pass? Find out before someone else checks.
A compliance review maps your data flows and returns a gap list with the evidence behind every finding.
