Data protection for eBay sellers: handling buyer details under UK GDPR

Does data protection law apply to eBay sellers?

Data protection for eBay sellers is not optional paperwork for big companies. GOV.UK says you must follow data protection rules if your business stores or uses personal information, and every eBay order gives you some: the buyer's name, delivery address, often a phone number, and the messages you exchange. In the UK the rules are the UK GDPR and the Data Protection Act 2018, and the Information Commissioner's Office (ICO) is the regulator.

eBay's own terms make the point directly. Section 13 of eBay UK's User Agreement says that you and eBay each process personal data as separate and independent controllers, and that you are individually responsible for complying with the obligations that apply to you as a controller under data protection law. A controller is the person or business that decides why and how personal data is used. For the buyer details you receive with each order, that is you.

What does eBay's User Agreement require?

eBay's User Agreement sets three rules for buyer data that go further than many sellers realise:

1. Purpose only. You must process personal data received from eBay exclusively for the purposes you received it for, such as completing and delivering the order.
2. Erase when done. You must erase that personal data immediately after the purpose has been fulfilled. Further processing is not allowed except when legally required, for example where a retention obligation applies.
3. Consequences. eBay says failure to follow these obligations may result in disciplinary action up to and including account suspension.

In practice, this means a buyer's address is for posting their order, handling a return and dealing with a claim. It is not for adding to a mailing list, sending offers outside eBay or building a customer database for another sales channel. eBay's feedback policy also says it removes feedback that contains personally identifiable information, which reflects the same idea: buyers' details stay private.

Erase when done, but keep tax records

The erase rule has an exception for legal retention duties. HMRC expects sole traders to keep business records for at least 5 years after the 31 January submission deadline of the relevant tax year, and sales records can include buyer names. The way to square the two is to keep only what your records need, such as the order number, date, item, amount and refund, and to delete or remove the rest, such as phone numbers, message threads and full addresses in your own files, once the order, any return and any claim are finished.

The principles to follow with buyer details

GOV.UK sets out the data protection principles everyone handling personal data must follow. Here they are, with what each means for an eBay seller.

GOV.UK also lists people's rights over their data, including the right to be informed about how it is used, to access it, to have incorrect data updated and to have data erased. If a buyer asks what you hold about them, you must respond; take a copy of what you hold and reply promptly.

Where buyer data leaks in an eBay business

Most data problems for small sellers are not hacks. They are ordinary habits that leave buyer details in places they should not be.

• Spreadsheets of orders downloaded from Seller Hub, saved to a laptop or shared drive and never deleted.
• Printed packing slips and labels left in a bin, a car or a shared office.
• Shared logins. A helper using your eBay password sees every buyer's details, and you cannot tell who did what.
• Personal email and chat apps, where addresses are forwarded to a supplier or packer and stay for years.
• Phones without a screen lock running the eBay app.
• Third-party tools connected to your eBay account that store order data you no longer use.

Practical security steps

• Use a strong, unique password and two-step verification on your eBay account and email.
• Give helpers their own access with only the permissions they need, rather than your password. Our guide to setting up access for an eBay virtual assistant explains how.
• Shred or securely bin printed slips and spoiled labels.
• Keep order exports in one protected folder and delete them on a set schedule.
• Review the apps connected to your eBay account and remove any you no longer use.
• Lock every device that can open Seller Hub or your order tool.

Our article on protecting your eBay account, supplier logins and buyer data goes further on tools and logins.

Sharing buyer details with suppliers, couriers and tools

Some sharing is needed to deliver the order. A courier needs a name and address, and sometimes a phone number. A wholesale supplier or fulfilment warehouse that ships for you needs the same. Share only those fields, through a secure route such as an integration or a protected file, and agree with the supplier how long they keep the data. As the controller, you remain responsible for choosing partners who look after it.

Do eBay sellers need to pay the ICO fee?

Under the Data Protection (Charges and Information) Regulations 2018, organisations, including sole traders, that use personal information must pay the ICO data protection fee unless they are exempt. Whether an exemption applies to you depends on how you use personal data, so check with the ICO's self-assessment on its data protection fee page. Our guide to the ICO fee for online sellers walks through the questions.

Worked example: one order's data, start to finish

Example: suppose a buyer orders a lamp. Here is a data-careful path through the order.

1. The order arrives in Seller Hub with the buyer's name, address and phone number.
2. You buy an eBay label, so the address goes from the order to the label without being copied anywhere else.
3. The packing slip is printed from the order and goes in the parcel; the spoiled first print is shredded.
4. The buyer messages about delivery; you reply through eBay messages, not personal email.
5. The order is delivered and no return is opened. After your return window and claim period have passed, you delete the order's row from your own export file, keeping only the order number, date, item and amount in your accounts.

The buyer's details were used for the order, seen only by the people who needed them, and not kept in extra places once the job was done.

A data protection checklist for eBay sellers

• Treat yourself as the controller of the buyer details you receive.
• Use buyer data only for the order, returns, claims and your legal records.
• Never add eBay buyers to marketing lists or contact them about sales outside eBay.
• Share only the fields couriers and suppliers need, through secure routes.
• Protect accounts with strong passwords and two-step verification, and give helpers their own access.
• Delete extra copies of buyer details once the order and any claim are closed.
• Check whether you must pay the ICO data protection fee.
• Respond to any request from a buyer about the data you hold.

Read section 13 of eBay UK's User Agreement and GOV.UK's data protection page, and ask the ICO or an adviser about anything specific to your business.