UK GDPR: 5 Steps to Keep Ecommerce Data Under Your Control

UK GDPR: 5 Steps to Keep Ecommerce Data Under Your Control

You, the merchant, normally own your customer data and are the Data Controller under UK GDPR. That legal status carries a hard requirement: you must be able to export, delete, and prove lawful use of that data on demand, regardless of which vendor’s dashboard it sits behind. Data ownership in ecommerce means custody, portability, reuse rights, and deletion control, not just login access. If you cannot pull a full export or trigger a deletion without opening a support ticket, you do not yet control your own data.

TL;DR:

• Most merchants fail to fully own their data because vendor exports often lack schema, event history, and reuse capabilities needed for practical control.
• UK GDPR requires merchants to have end-to-end deletion proof and full data exports, which many vendors do not support without support tickets or custom engineering.
• Regular testing of data exports and deletion capabilities from key vendors is critical, as APIs and schemas can change quietly, risking non-compliance.
• Data governance tools like Microsoft Purview enable merchants to discover, classify, and enforce policies across scattered systems without heavy engineering.
• Owning try-on and sizing data directly improves margins by reducing returns and enables better personalization and compliance with data rights deadlines.

div style="border-radius:26px;padding:min(14px,3.2vw);background:radial-gradient(circle at 100% 0%,#f5f3ee 0 150px,rgba(255,255,255,0) 151px),radial-gradient(circle at 0% 100%,#f5f3ee 0 130px,rgba(255,255,255,0) 131px),linear-gradient(180deg,#f9f7f4 0%,#fcfbf9 100%);">

div style="background:#ffffff;border-radius:18px;box-shadow:0 12px 34px rgba(0,0,0,0.13);overflow:hidden;">

div style="display:flex;flex-wrap:wrap;align-items:center;gap:16px 22px;padding:20px 24px;">

div style="flex:1 1 260px;min-width:0;">

div style="margin:0 0 8px;"> Garmcheck

Keep Your Fitting Data Under Control

GarmCheck helps Shopify fashion brands manage try-on and sizing data while improving fit confidence and reducing returns.

Explore GarmCheck

Table of Contents

• Data ownership ecommerce: what custody, portability and deletion actually cover
• Controller versus processor: your legal duties under UK GDPR
• Why data ownership decides which merchants survive platform changes
• Five practical actions to assert control of your customer data
• Governance tools that make ownership practical without heavy engineering
• Why owning try-on and sizing data protects margins in fashion ecommerce
• Author viewpoint: priority checklist for the next 6 to 12 months
• How Garmcheck supports the ownership model for fashion merchants
• Sources
• FAQ

Data ownership ecommerce: what custody, portability and deletion actually cover

Data ownership in ecommerce splits into four practical tests, and most merchants only pass one or two of them. Having a dashboard is not the same as owning the data behind it. Custody means the records sit in a database or export you control, not one you merely view through a vendor’s interface. A platform that lets you log in and see reports but blocks a full data pull has captured your data, not shared it.

Portability is the second test, and it is where most merchants discover the gap. A usable export is machine readable: full order history, event logs, customer schema, and audit trails, not a CSV of names and email addresses. If a vendor’s “export” strips out the fields you need for a migration, data governance for online stores becomes theoretical rather than operational.

Reuse rights matter just as much. Some vendors technically hand over data but wrap it in API limits, paywalled endpoints, or middleware that makes reuse impractical.

• Custody : can you point to the actual database or storage layer, not just a login screen?
• Portability : does the export include schema and event history, not just flat customer lists?
• Reuse : can you feed that data into another tool without new fees or engineering work?
• Deletion : can you erase a customer’s record end-to-end and produce proof it happened?

Deletion is the test regulators care about most. When a customer exercises their erasure rights, you need an auditable trail showing the record was removed everywhere it lived, not just in your primary database.

Controller versus processor: your legal duties under UK GDPR

Merchants are nearly always the Data Controller under UK GDPR, because you decide the purpose and means of processing customer data, even when a third party hosts it. Using a virtual try-on app, an email platform, or a payments processor does not shift that liability. Vendors typically act as processors under UK GDPR, working on your documented instructions, and the compliance burden stays with you.

That status brings concrete obligations. Article 28 contracts between you and any processor must set out:

• Documented processing instructions, scope, and duration.
• Security measures appropriate to the data’s sensitivity.
• Audit and inspection rights so you can verify compliance.
• Sub-processor disclosure and approval rights.

Assessing processors is not a one-off signature exercise. The ICO frames it as an ongoing duty, meaning you need periodic reviews and dated evidence that those reviews happened, not a contract filed away and forgotten.

Why data ownership decides which merchants survive platform changes

Platform lock-in is the clearest survival risk. When a vendor removes an export feature, changes API pricing, or gets acquired, merchants without genuine custody face an operational crisis, not an inconvenience. Migrations that should take weeks stretch into months because the underlying schema was never yours to move.

Machine learning and personalisation suffer the same fragility. Recommendation engines, segmentation, and lifetime value modelling all depend on raw behavioural signals. If those signals live only inside a third-party black box, you cannot rebuild the model elsewhere, and you cannot audit what it is doing with your customers’ data.

Regulatory risk compounds this. Under UK guidance, data subjects have rights including access, portability and erasure , and organisations must usually respond within the statutory UK GDPR timeframe. A merchant who cannot locate every copy of a customer’s record across five disconnected tools will miss that deadline, and the ICO does not accept “our vendor was slow” as a defence.

Ownership underpins trust, too. Customers increasingly expect brands to know what they hold and why. Merchants who can demonstrate clean data practices convert that into safer segmentation, more accurate lifetime value forecasting, and fewer awkward conversations when a customer asks what you know about them.

Five practical actions to assert control of your customer data

Ownership is not a legal abstraction; it is a set of operational habits. Here is where to start.

• Record your processing activities. Document what data you collect, why, and confirm in writing that you are the controller for each system, not the vendor.
• Audit every vendor contract. Check for named export formats, deletion service-level agreements, sub-processor disclosure clauses, and audit rights. Missing any of these is a red flag.
• Automate exports and keep off-vendor backups. Schedule regular pulls of orders, customer records, and event logs into storage you control, and test restoring from them.
• Map retention and deletion workflows to actual legal rights. Every deletion request needs a logged trail across all systems that touched that record, not just your primary database.
• Assign one accountable owner for your single customer view. Someone needs to own matching rules and log every merge or split, because unclear governance of a single customer view is one of the fastest ways to lose an audit trail.

Pro Tip: Run a full export and a full deletion test on your busiest vendor every quarter, not just once at onboarding. Vendors change their APIs quietly, and the only way to catch it is to keep testing.

Governance tools that make ownership practical without heavy engineering

You do not need a data engineering team to run this properly. Data catalogue and federated governance platforms, such as Microsoft Purview , let you discover, classify, and enforce access policies across scattered systems, which turns ownership from a compliance chore into something searchable and provable. Purview’s model favours federated governance: central rules for sensitive fields like identity, paired with controlled self-service for teams that need day-to-day access.

A customer data platform or a single customer view tool serves a narrower but related purpose: controlled activation of customer data for marketing and personalisation, while the raw records stay under your custody rather than the activation tool’s.

• Ask every vendor for their current sub-processor list and re-check it annually.
• Request a security questionnaire before signing, not after an incident.
• Set a fixed audit cadence, quarterly or twice yearly, and put it in the calendar.

Why owning try-on and sizing data protects margins in fashion ecommerce

Try-on and sizing data is some of the most sensitive and commercially valuable data a fashion retailer holds. It touches body measurements, sits close to identity, and directly drives two numbers that decide margin: return rates and conversion. When a merchant owns structured try-on records rather than renting access to them, size recommendations improve over time, return on investment becomes measurable, and returns tied to poor fit start dropping. Garmcheck’s guidance on customer photo privacy and its virtual try-on privacy checklist both set out what to check before letting any vendor touch this data class.

Author viewpoint: priority checklist for the next 6 to 12 months

If you do one thing this quarter, run an export test and a deletion test on your two highest-risk vendors, then fix whatever contract gaps that exposes. Name a single owner for your customer view now, not after a data incident forces the question.

Over the next two to four quarters, move towards federated governance and run at least one full migration dry run, even if you have no plan to switch vendors yet. Treat it as a fire drill. Escalate immediately if a vendor stalls on export requests more than once, or if you miss a subject rights deadline. That pattern rarely improves on its own.

— Jack

How Garmcheck supports the ownership model for fashion merchants

Garmcheck is built around the same principle this guide argues for: the try-on and sizing data your fit tool generates should belong to you, not sit locked inside someone else’s proprietary format. Every try-on produces structured records, eight body measurements per customer, garment-specific fit analysis, and returns analytics, built to integrate cleanly with Shopify and Klaviyo rather than trap that data in a closed system.

That structure matters because poor fit drives the majority of fashion returns, and a virtual try-on tool that hands you clean, exportable sizing data lets you actually act on that problem instead of just watching it happen. Garmcheck’s Why Garmcheck page sets out how the fit and privacy model works, and the size recommendation tool shows the measurement output directly. Plans run from a Free tier through Starter at £99 per month, Growth at £399 per month, and Scale at £999 per month, all detailed on the Garmcheck pricing page . Start with the free trial and check whether your current try-on data is actually yours to keep.

Sources

For the legal and technical detail behind this guide, go directly to the primary sources: the ICO’s controllers and processors guidance, gov.uk’s data subject rights guidance, and the Microsoft Purview governance overview for a practical governance framework. For blockchain-based audit trail approaches to proving data custody, see this overview of blockchain APIs in ecommerce .

• Gov
• Responsibilities and liabilities for controllers using a processor | ICO
• Microsoft Purview unified catalog overview

FAQ

What does “data ownership” mean in ecommerce?

It means you hold custody of the raw data (not just dashboard access), can export it in a usable format, can reuse it freely, and can delete it end-to-end with proof. A merchant who fails any one of those four tests does not fully control their customer data, even if a vendor’s interface makes it look otherwise.

Can you give examples of data ownership in an online store?

A clear example is holding your own copy of order history, customer profiles, and event logs in a database or warehouse you control, separate from any single app’s proprietary storage. Another is being able to run a full export and deletion test on a vendor without needing their support team to intervene.

What are the best data governance tools for online stores?

There is no single fixed list, but the leading category includes data catalogue and federated governance platforms such as Microsoft Purview, customer data platforms for controlled activation, and specialised tools like Garmcheck for structured, exportable try-on and sizing records. The right combination depends on your data volume and how many systems touch customer records.

What determines who owns ecommerce customer data?

Ownership is determined by who decides the purpose and means of processing, which under UK GDPR makes the merchant the Data Controller in almost every case, not the software vendor. Contract terms then decide whether that legal ownership translates into practical control, which is why export rights, audit access, and deletion clauses matter as much as the law itself.

How quickly must merchants respond to a customer data request?

Organisations must usually respond to subject access, portability, or erasure requests within one month. Missing that deadline because a vendor was slow to locate a record is still the merchant’s compliance failure, not the vendor’s.

Recommended

• Ecommerce sizing personalisation: a practical playbook
• 12 Point Virtual Try On Privacy Checklist for UK Compliance Teams