Insights
Is Magento GDPR Compliant? UK GDPR and PCI DSS Responsibilities
No ecommerce platform is "GDPR compliant" on its own, and Magento is no exception. Compliance depends on how the store is run: why you collect personal data, what you tell customers, how you use cookies, how you answer their requests and how you keep their data secure. Magento gives you some tools, your host can secure the server and keep the data in the UK, and the table below sets out who does what for UK GDPR and PCI DSS. This guide is general information, not legal advice.
General information, not legal advice.
UK GDPR basics for an online store
As the store owner, you are the controller of your customers' personal data, so most UK GDPR duties sit with you. These are the points the ICO's guidance covers that matter most for a store:
- Lawful basis. There are now seven lawful bases, after the Data (Use and Access) Act added "recognised legitimate interest". For most stores, the relevant ones are contract, legal obligation, legitimate interests and consent.
- Privacy information. Your privacy notice must say who you are, why you use the data, your lawful basis, how long you keep it, people's rights and their right to complain to a supervisory authority, plus recipients and international transfers where they apply.
- Cookies. Under PECR, you need consent to store or read information on a visitor's device unless one of five exceptions applies, which have been in force since 5 February 2026. Analytics for statistical purposes and appearance or functionality cookies can be exempt, but only if you give clear information and a simple, free way to object. Advertising cookies always need consent.
- Subject access requests. Respond without undue delay and within one month, extendable by up to two months for complex requests.
- Erasure. The right is not absolute. Where it applies, data in backups must be put "beyond use".
- Retention. Keep personal data no longer than you need it, with a retention policy you review.
- Security. Use "appropriate technical and organisational measures".
- Breaches. Report a reportable breach to the ICO within 72 hours of becoming aware of it, where feasible, tell affected people without undue delay if the risk to them is high, and keep a record of every breach.
- Complaints. Since 19 June 2026, you must give people a way to complain about how you use their data and acknowledge complaints within 30 days.
- Data protection fee. Most organisations that use personal information must pay the ICO's fee unless they are exempt.
- Processors. A cloud or hosting provider acting on your behalf is typically your processor, and you need a written contract with the terms set out in Article 28.
- International transfers. A "restricted transfer" is a transfer to a separate organisation outside the UK, and making data accessible counts. Hosting in the UK doesn't stop transfers through support tools, apps and other services you add.
PCI DSS basics for a Magento store
PCI DSS applies to any business that stores, processes or transmits card data, and your acquirer decides how you prove compliance, usually with a Self-Assessment Questionnaire.
PCI DSS v4.0.1 is the only active version, and its future-dated requirements took effect on 31 March 2025. Most Magento stores take card payments through a hosted payment page or an embedded form from their payment provider, which reduces what they are responsible for. For SAQ A, the PCI Security Standards Council says the scripts criterion applies to pages with an embedded payment iframe, not to stores that redirect to the provider's page, and it can be met by protecting the page's scripts or by written confirmation from the payment provider. Your acquirer confirms which questionnaire applies. For what the server side involves, see PCI DSS and Magento hosting. EveryHost holds no PCI DSS attestation of its own; we provide hosting that helps you meet PCI DSS.
Magento features that help
Magento has some useful tools, and some gaps:
- Cookie Restriction Mode, under Stores > Settings > Configuration > General > Web > Default Cookie Settings, shows visitors a notice with an Allow button. Adobe describes it as a notice, not a full consent tool, so most stores add a consent platform for PECR.
- Admin security: two-factor authentication has been on by default since Magento 2.4.0, alongside admin user roles, session lifetime, lockout after failed sign-ins and password lifetime settings. The admin action log is Adobe Commerce only.
- Deleting a customer is possible in the admin, but Adobe notes that activity and transaction information is kept.
- Exporting customers in bulk is possible in the admin, but it isn't a per-person subject access tool.
- No self-service tools in core: neither Magento Open Source nor Adobe Commerce lets customers download or delete their own data from their account. Stores use extensions or custom work.
- Adobe's personal data reference lists the database tables that hold customer data, which helps when answering requests.
Who is responsible for what
This is how UK GDPR and PCI DSS tasks usually split for a Magento store hosted with EveryHost. Your own arrangements may differ, so check your contracts.
| Task | Merchant (you) | Payment provider | Host (EveryHost) | Developer or agency |
|---|---|---|---|---|
| Lawful basis and privacy notice | Decides the basis and publishes the notice | Covers its own processing | Not involved | Builds the pages |
| Cookie consent (PECR) | Decides which cookies run and how consent works | Its own cookies on its pages | Not involved | Installs the consent tool and tags |
| Subject access and erasure requests | Responds within the time limits | Handles data it holds | Provides server and database access for finding data | Builds any tools needed |
| Retention | Sets retention periods | Its own periods | Keeps backups as described in your plan | Implements clean-up of old data |
| Server security | Keeps admin accounts and passwords secure | Not involved | Isolated servers, operating system and server stack security updates, server firewall, Sentinel monitoring | Not involved |
| Magento security patches | Approves patching | Not involved | Applies them on Fully Managed, staging first; coordinates production on other plans | Applies them on Standard and Managed plans |
| Backups | Keeps an independent copy | Not involved | On-server backups on every plan; Bastion off-site backup as an add-on, included up to 50 GB on Fully Managed | Not involved |
| Access control | Manages admin users and two-factor authentication | Manages access to its dashboard | Manages server, SSH and SFTP access | Uses only the access it needs |
| Card data | Chooses a hosted payment page or form | Handles card data and its own PCI DSS compliance | Runs the server; holds no PCI DSS attestation | Integrates the payment module |
| PCI DSS questionnaire | Completes it with the acquirer | Confirms its part, such as script protection for embedded forms | Answers the server-side questions | Supplies technical details |
| Breach notification | Reports to the ICO within 72 hours where feasible, and tells customers if the risk is high | Tells you about incidents on its side | Tells you without undue delay about a security incident on our side | Helps investigate |
| Processor contracts | Has Article 28 terms with each processor | Its own terms | Acts as a processor for the store's data | Its own terms if it handles personal data |
| Data location | Chooses where data is held | Its own locations | Stores your data in our London data centre | Not involved |
| Complaints and the ICO fee | Runs a complaints process and pays the fee unless exempt | Not involved | Not involved | Not involved |
What EveryHost provides
For stores we host, we run the server side: isolated servers in our London data centre, operating system and server stack security updates, a server firewall and Sentinel security monitoring, which reads your server's logs and blocks abusive sources at the server firewall. Sentinel is not a web application firewall, a malware scanner or DDoS protection; if you want a WAF or CDN, we recommend Cloudflare, on your own account, which becomes another provider to include in your records. We also run a daily read-only malware scan of your files, which detects but doesn't remove anything.
Our Fully Managed plan, £169 a month + VAT, adds Magento security patching, staging first, and Bastion off-site backup up to 50 GB. Every plan includes 24/7 UK support by ticket. We can work with you to help meet your UK GDPR obligations, depending on the services and extensions you use, but hosting in the UK on its own doesn't make a store compliant.
This is not legal advice
This guide is general information about UK GDPR, PECR and PCI DSS as they applied on 13 October 2026, written by a hosting company, not a law firm. For decisions about your own store, read the ICO's guidance, speak to your acquirer about PCI DSS, and take legal advice where you need it.
Sources
All accessed 13 October 2026.
- ICO: A guide to lawful basis
- ICO: What privacy information should we provide?
- ICO: Storage and access technologies, the exceptions
- legislation.gov.uk: SI 2026/82 (commencement)
- ICO: A guide to subject access
- ICO: Right to erasure
- ICO: Storage limitation
- ICO: A guide to data security
- ICO: Personal data breaches
- ICO: How to deal with data protection complaints
- ICO: Data protection fee
- ICO: Contracts between controllers and processors
- ICO: A brief guide to international transfers
- PCI SSC: Merchants
- PCI SSC: PCI DSS v4.0.1 published
- PCI SSC: FAQ on SAQ A eligibility criteria for scripts
- Adobe: Cookie law compliance
- Adobe: Manage customer accounts
- Adobe: Admin security settings
- Adobe: Action logs report (Adobe Commerce only)
- Adobe: Customer personal information reference
Frequently asked questions
Want your server side looked after?
We run secure Magento servers in our London data centre and can work with you on the server-side questions in your UK GDPR and PCI DSS work.