GDPR for a One-Person eBay Shop, Realistically

The assumption worth correcting first

It is a common assumption that being small - a sole trader, a one-person operation, no staff at all - puts a business below some informal size threshold GDPR does not bother with. There is no such threshold. The ICO's own data protection fee page is explicit that under the Data Protection (Charges and Information) Regulations 2018, organisations - including sole traders by name - that use personal information need to pay a data protection fee, unless a specific exemption applies. Size on its own has never been the test for whether the fee applies.

The exemptions that actually exist, and what they do not cover

Checked 27 September 2026: a specific, narrow list of purposes is exempt from the fee - among them, processing personal data purely for "accounts and records for your own organisation," and purely for "advertising, marketing and public relations of your own goods and services." Both sound, at a glance, like they might cover a lot of what a small shop does. Neither one covers the actual processing at the centre of running an eBay shop: taking a real buyer's name and delivery address and using it to get an order to their door. That is order fulfilment, not accounts and records, and it sits outside both of the exemptions above - which means most sellers doing it through any kind of computer system, spreadsheet, or software are very likely required to register and pay.

Worth being precise about what "purely" is doing in each exemption's own wording: if a business processes personal data for both an exempt purpose and a non-exempt one - accounts and records, and also order fulfilment - the exemption does not stretch to cover the whole business. It only ever applied to the narrow purpose it was written for.

What the fee actually costs, at the tier almost every small shop falls into

The ICO's own guide to the data protection fee sets out three tiers, with the fee ranging between £52 and £3,763 depending on turnover and staff numbers. Tier 1, the "micro organisations" band, applies to anyone with a turnover of no more than £632,000 for the financial year or no more than 10 members of staff, and carries a fee of £52 - a band that covers essentially every genuinely small, one-person eBay dropshipping shop by a wide margin. This is worth knowing plainly because the actual sum involved is modest, not the significant ongoing cost the word "GDPR" tends to conjure up in the abstract - a one-off annual payment, not a recurring drain worth any real anxiety over once it is actually paid.

Why it is worth using the ICO's own tool rather than guessing either way

Rather than assuming the fee applies, or assuming it doesn't, the ICO's own self-assessment tool is worth running directly - a genuine, roughly ten-minute check that gives a specific, individual answer rather than a guess based on a general reading of the rules above. This is worth doing even for a shop that feels confident it already knows the answer, since the self-assessment also confirms the correct tier and flags any specific exemption that might genuinely apply to a particular situation that the general rules above do not cover.

What GDPR itself actually asks of a one-person shop

Separately from the fee question, the substance of GDPR compliance for a genuinely small shop comes down to a manageable handful of practical habits rather than a large compliance programme: collecting only the buyer details an order genuinely needs, rather than copying more into a spreadsheet than will ever actually be used; keeping that data only as long as it is genuinely needed - long enough to cover realistic dispute and return windows, not indefinitely out of habit; and keeping wherever it lives reasonably secure, whether that is a password on a laptop, a locked spreadsheet, or a proper login on any software used to run the shop. None of this requires a legal team. It requires deciding, deliberately, what gets written down and for how long, rather than letting every tool default to keeping everything forever.

A small, concrete example of the same principle

The instinct to write down "anything worth remembering" against an order - a note to check something later, a reminder about a specific buyer's request - is a genuinely useful habit, and also exactly the kind of place buyer-identifying detail can quietly accumulate if it is never reviewed. The honest discipline is the same one GDPR itself is really asking for: write down what is actually useful, and let it go once it has served its purpose, rather than letting a running note field become an unplanned, permanent record of buyer details nobody ever intended to keep that long.

What changes once buyer data leaves the seller's own hands

The same discipline needs a second, separate thought the moment buyer data is shared with anyone else - a virtual assistant handling messages, a supplier fulfilling an order, an accountant looking at order records. Sharing a buyer's name and address with a supplier to dispatch an order is an unavoidable, routine part of how dropshipping works and is not itself a problem, but it is worth being at least briefly deliberate about who else has access to buyer data and why, rather than granting broad access by default because it is simpler to set up. A VA given full access to every order's full history, when the actual task only ever needed the current order's tracking number, is being given more than the task actually required - worth trimming access back to what a specific role genuinely needs, the same minimisation principle applied to people as well as to what gets written down. This does not need a formal written policy to be worth doing at a small scale - simply noticing, deliberately, who can see what, and turning off access nobody is actually using any more, closes most of the real gap in practice, without needing anything more formal than a moment's honest thought about it.

What actually has to happen if buyer data is genuinely lost or exposed

Beyond the ordinary, preventive habits above, it is worth knowing what GDPR actually requires if something does go wrong - a stolen laptop holding an unencrypted spreadsheet of buyer addresses, or an export accidentally shared with the wrong person. The ICO's own guidance on personal data breaches confirms a genuine legal duty to report a qualifying breach to the ICO within 72 hours of becoming aware of it, where feasible, and to inform the affected individuals directly, without undue delay, if the breach is likely to put their rights and freedoms at real risk. A further detail worth knowing: a record of every breach has to be kept regardless of whether it was serious enough to actually require reporting, meaning even a minor, non-reportable incident still needs to be noted down internally rather than simply forgotten once resolved. This is worth knowing about directly rather than discovered for the first time in the middle of an actual incident, when a clear head and a plan already in mind matter considerably more than they do reading about it calmly in advance.

What actually happens if the fee genuinely goes unpaid

It is worth knowing the fee is not simply a polite suggestion - the ICO can and does issue a monetary penalty for non-payment where it applies, separate entirely from any wider data protection breach, and it is worth treating this as a real, if modest, compliance obligation rather than an optional extra to deal with "eventually." For a small shop, paying a correctly assessed £52 a year is a straightforward, minor cost; the risk worth avoiding is not the fee itself, but the position of having never checked at all and only discovering the obligation existed after a penalty notice arrives rather than before it was ever due.

What this actually means to do, practically

Check whether the ICO fee genuinely applies using the ICO's own self-assessment tool rather than assuming either way, register and pay if it does - for most sellers this is a modest annual amount, not a significant cost - and apply the same three habits above to wherever buyer data is actually stored, spreadsheet or otherwise: collect only what is needed, keep it only as long as it is needed, and keep it secure while it exists. This is a genuinely small, achievable list for a one-person shop, once the specific things worth doing are separated from the general anxiety the word "GDPR" tends to produce.

Where Sellhelm actually fits

Sellhelm's own order pages read a buyer's live name and address straight from eBay when needed and do not store a separate copy of it anywhere in the tool itself - the same data-minimisation principle above, built directly into how the order screen works, rather than left as a separate habit to remember on top of everything else.

Questions people ask