Question 1

Do Shopify / BigCommerce / Square stores need PCI-DSS?

Accepted Answer

Where you use a hosted e-commerce platform with built-in tokenisation (Shopify Payments, Stripe, Square), most of the PCI scope is reduced — but merchant-level SAQ still applies (typically SAQ-A-EP or SAQ-A). Annual SAQ plus quarterly external vulnerability scan still required by your acquirer. We document the SAQ in the posture typical for modern hosted platforms: direct-to-PSP, redirect, or popup iframe flows.

Question 2

How does BEC hit retailers?

Accepted Answer

Supplier PO BEC is the largest pattern: fraudster compromises an overseas / supplier mailbox, sends 'updated bank details' to your buying team for ongoing POs — significant typical loss when the next purchase invoice settles to fraudster account. Second pattern: fraudulent marketing agency invoicing / SEO / ads 'rebill' emails. Callback verification + finance mailbox monitoring prevent.

Question 3

What happens when a customer-facing breach hits?

Accepted Answer

Article 33 ICO notification within 72 hours of awareness. Article 34 customer notification required if 'high risk to individuals' — typically if password data leaked (account takeover risk), payment data exposed (financial loss), or identity elements leaked (medical / health store, financial). We coordinate both, plus your acquirer notification (PSP breach notification has its own clock) and the press / statement if it's already public.

Question 4

Why does PCI-DSS still apply to hosted e-commerce?

Accepted Answer

Because you are the merchant of record. You may not store PANs (card numbers) directly — most hosted PSPs shield you from that — but you remain PCI-DSS applicable as a level based on transaction volume. SAQ-A applies for fully redirect; SAQ-A-EP applies for iframe / API-based. Annual SAQ + quarterly ASV scan retained as evidence typically demanded by your acquirer.

Question 5

We have multiple stores and a head office — how is SOC managed?

Accepted Answer

Multi-site retail under one M365 / Google Workspace tenant: conditional access at tenant level, per-site admin segmentation via Entra Administrative Units, finance mailbox per site, centralised audit. Most UK multi-site retailers we work with operate on a single tenant with centralised ops teams — manageable as one subscription.

Question 6

Customer data and UK GDPR — what's the legal basis for marketing emails?

Accepted Answer

Lawful basis for marketing is usually 'legitimate interest' under UK GDPR Article 6(1)(f) — but this requires LIA (legitimate interests assessment). For new customers from a checkout consent capture, that's clearer. After a purchase, you may have legitimate interest to send them further offers. Email vendors (Klaviyo, Mailchimp, Dotdigital) all integrate with e-comms — processor agreements must cover this. ICO enforces via marketing / electronic comms regs (PECR), often GDPR-compliant.

Question 7

Does compliance with UK GDPR require taking 'consent' for everything?

Accepted Answer

No — it's more nuanced. For marketing emails post-purchase, 'soft opt-in' under PECR is often sufficient if you reasonably obtained the contact during a sale. For non-marketing (order updates, account info) you can usually fall back on contract performance basis. For new third-party sharing or special purposes, separate consent is needed. We document the lawful-basis register for typical e-commerce flows.

Cyber Security for Retail & E-commerce — UK Multi-channel Retailers & Online Stores

Cybersecurity Consulting + 24/7 SOC Monitoring

Cybersecurity Consulting

Managed SOC Monitoring · 24/7

Pricing tailored to your needs

What we cover

Managed SOC for M365 / Google Workspace

PCI-DSS Level 2-4 SAQ evidence pack

E-commerce platform monitoring

Customer account data + UK GDPR Article 34 comms

Multi-site stock-management + EPOS monitoring

Supplier PO BEC prevention

How we work

Scoping (Week 1)

Deploy (Week 1-2)

PCI + breach comms (Week 2-3)

Operate (ongoing)

Sectors we protect

Cybersecurity for retail that protects customers + PCI compliance

Frequently asked questions