A treatise on e-commerce data security and compliance

In just a few short years, e-commerce has gone from 15% of retail sales to 22%. After dramatically uprooting the landscape of business, COVID-19 continues to have a lasting effect on the way consumers shop.

Rather than being a temporary trend during the height of the pandemic, quarantine was just a jumping-off point for the rise of e-commerce. Today, e-commerce is bigger than ever, and businesses are scrambling to come to terms with this new business channel's new data security and compliance needs.

E-commerce data security and compliance are not options—they're essentials for any business seeking success in the current state of the retail industry. Keeping up with changing requirements and tactics is daunting, but companies like Optimizely specialize in e-commerce platforms and create connections between businesses and certified experts.

Key takeaways: 

• Data Security involves the principles of privacy, integrity, authentication and nonrepudiation.
• Regulatory compliance for e-commerce platforms is more comprehensive than for brick-and-mortar commerce.
• Optimizely can help your company take its e-commerce platform to the next level.

Components of e-commerce data security

Cyber security is one of the most difficult and quickly evolving areas of e-commerce. Keeping up with the changing needs of data security requires knowledge of its components: privacy, integrity, authentication and nonrepudiation.

1. Privacy

Privacy encompasses both your organization's privacy and your customers' privacy. Privacy control prevents unauthorized actors from accessing protected information. When users conduct business with your e-commerce platform, they expect confidentiality. Once the seller breaks that trust, it's irreplaceable.

Some basic tools for e-commerce privacy are encryption, anti-virus software and firewall protection. These tools help stop unwanted entities from accessing the private information of your organization and your organization's customers.

2. Integrity

In addition to their expectation of confidentiality and privacy, customers expect the data they provide to your organization will remain unaltered. In other words, customers expect that their data will maintain integrity. Businesses protect the integrity of their customer's data by putting safeguards in place to prevent changes in customer data.

In e-commerce, some safeguards can include data backups, data validation, and a detailed audit trail to record when information is changed and by whom.

3. Authentication

While the principle of privacy focuses on keeping unauthorized users out of your customer's data, the principle of authentication focuses on identifying which users are legitimate and which ones are not.

Authentication is important because it tells organizations that their customers are who they say they are, and it tells customers that their sellers are who they say they are too. Authentication controls for e-commerce include two-factor authentication, password protection, PINs and biometrics. Authentication is vital for preventing bad actors from accessing sensitive data.

image source

4. Nonrepudiation

While the other components of e-commerce security are terms you might hear from a layperson on the street, "nonrepudiation" is less colloquially familiar. Nonrepudiation is assurance that when a party (either the buyer or seller) acts, they can't deny it at a later date.

For example, when a buyer signs a digital contract, nonrepudiation ensures that they can't claim to have never signed it and can't accuse the seller of signing it on their behalf. Nonrepudiation in e-commerce involves the use of cryptography and digital signatures.

Components of e-commerce data compliance

E-commerce data security and compliance go hand in hand. Regulatory compliance ensures that organizations are living up to recognized standards of security. This prevents companies from going rogue and exposing their customers to data breaches due to negligent security practices.

As with any industry, e-commerce compliance involves following regulations from EU to state and local laws. E-commerce is more nuanced than brick-and-mortar retail or manufacturing because e-commerce platforms can frequently do business with customers from other states or even other countries, so e-commerce companies should be aware of all the regulations that might apply to their transactions.

Understanding state laws

Unlike brick-and-mortar retail stores that operate in a specific location, e-commerce platforms are available to anyone with an internet connection. This means they must stay aware of current state regulations that could impact their business.

The most noteworthy state law is the California Consumer Privacy Act (CCPA), which many other states model their laws after. The CCPA gives consumers the right to request information about what kind of data the seller collects and why the seller collects that data. The CCPA also gives consumers the right to opt-out of having their information sold by the seller and gives them the right to request that information already collected be deleted.

While the CCPA only applies to businesses of a certain size (over $25 million in gross revenue, collecting information from 50,000 or more customers or deriving 50% or more of their revenue from the sale of customer information), as long as an organization meets any one of those thresholds, it applies to any business that collects information from California residents, regardless of what state the business operates in.

Nevada and Maine have instituted similar laws requiring sellers to allow customers to opt-out of having their information sold, and several more states have passed laws requiring sellers to notify customers of data breaches.

GDPR

The General Data Protection Regulation (GDPR) applies to any organization that processes personal information from EU residents. This means that although e-commerce giants like Amazon in the United States and Alibaba in China don't headquarter within the EU, GDPR still applies to them as long as they process data from customers residing in the EU.

While the CCPA requires the seller to allow buyers to opt-out of having their data collected and sold, the GDPR requires the seller to collect permission from the buyers before they can collect or sell any data. Because of that significant difference in consent, the CCPA is the "opt-out" model, while the GDPR follows the "opt-in" model because organizations can only collect or sell data after buyers grant express permission.

PCI DSS

While its name is a mouthful, the Payment Card Industry Data Security Standard (more catchily known as PCI DSS) is an essential consumer protection component. As the name implies, PCI DSS is a standard for how organizations can collect and store credit card data with steep fines for noncompliance.

Since credit card data is one of the most sensitive components of a customer's data, PCI DSS is not a one-stop shop for e-commerce security, but it lays the baseline groundwork for companies to start at.

Digital experiences through Optimizely

When you're managing the security of your customer's data, it's important that you do it right.

The complexity of navigating these security principles and regulatory requirements makes the barrier to entry for e-commerce platforms steeper than brick-and-mortar retail, but that doesn't mean it's impossible.

Optimizely is a digital experience platform that specializes in e-commerce. 

Whether you're looking for new ways to manage your content, optimize your digital experiences, or scale your e-commerce platform, Optimizely is equipped to help B2B and B2C companies of any size.

If you're ready to upgrade your digital experiences, book a meeting or request a call today to learn how Optimizely can help.