Operator duties do not end when the shop goes live: the privacy policy and consent banner have to match the services actually in use, data processing agreements have to match the providers actually commissioned, and mandatory information on prices, shipping and withdrawal has to match the current assortment. This category covers the recurring review of these points, handling changes at payment and shipping providers, retention periods for order and invoice data, deletion concepts for customer accounts and the requirements of the German Accessibility Strengthening Act. We describe which evidence should be produced during operations and how to build the review into the maintenance rhythm. The articles do not replace individual legal advice. We also describe which evidence can be collected during ongoing operations so that an audit does not turn into a search through the inbox.
NIS2 requires patch, backup and access management, MFA, incident reporting and supply chain security - how an SLA maintenance contract translates the duties into operations.
Since 28 June 2025 the EAA/BFSG applies to shops. Why WCAG 2.2 AA conformance decays with each update and how recurring maintenance checks keep it intact.