The Estonian Data Protection Authority (AKI) has published a series of recommendations aimed at online commerce sites to strengthen the security of personal data.

The authority emphasizes that security breaches often stem from simple errors, such as outdated software, overly broad access rights, or data collection exceeding actual needs. It reminds that company size offers no protection against cyberattacks, as small businesses frequently use standard platforms with known vulnerabilities. The data minimization principle is highlighted, urging merchants to collect only strictly necessary information, such as avoiding requesting a residential address for delivery to a pickup point. This vigilance should also apply to data collected via visitor behavior tracking tools on the site.

Among the most common risks is the delay in installing security updates; the authority cites a case where an organization was compromised in less than a day due to such a delay. The use of multi-factor authentication is also recommended. The security of subcontractors (payment solutions, logistics, etc.) must be audited, negotiating data protection aspects beyond general terms and conditions. In case of an incident, it is imperative to act quickly to limit damage, even if it means temporarily closing the site, then assessing the extent of the breach and informing the data subjects if a risk to their rights and freedoms is identified.