Operator duties do not end when the shop goes live: the privacy policy and consent banner have to match the services actually in use, data processing agreements have to match the providers actually commissioned, and mandatory information on prices, shipping and withdrawal has to match the current assortment. This category covers the recurring review of these points, handling changes at payment and shipping providers, retention periods for order and invoice data, deletion concepts for customer accounts and the requirements of the German Accessibility Strengthening Act. We describe which evidence should be produced during operations and how to build the review into the maintenance rhythm. The articles do not replace individual legal advice. We also describe which evidence can be collected during ongoing operations so that an audit does not turn into a search through the inbox.
On this page you will find all posts on the topic “Law & compliance”. The newest posts are at the top.
Below each title there is a short text about it. Click on a post. Then you can read the whole text.
Above the list you also see the other topics. At the bottom, a link takes you back to all posts.
How long may IP addresses stay in server logs? What the GDPR requires, what the five weeks from the BfDI mean, and how rotation, truncation and backups fit in.
In January 2027 the paper period ends above the turnover limit. What the shop must produce, hand over and archive for eight years as a structured invoice.
From 27 September 2026 product pages need the harmonised warranty notice and, where it applies, the durability label. Three zones, checkpoints, evidence.
Since 19 June 2026 section 356a BGB requires an electronic withdrawal function. Who is covered, what the two stages look like and what maintenance checks.
Keep terms, withdrawal, imprint and price information compliant: why legal texts age, where the warning risk lies and how technical upkeep works in the shop.
After every update scripts load before consent: how a script inventory, an audit log, blocked-by-default tags and CSP keep the consent setup current.
NIS2 requires patch, backup and access management, MFA, incident reporting and supply chain security - how an SLA contract turns the duties into practice.
Since 28 June 2025 the EAA/BFSG applies to shops. Why WCAG 2.2 AA conformance decays with each update and how recurring maintenance checks keep it intact.