Two-factor sign-in, passkeys and GDPR requests: the security a small shop actually needs

This is for the shop owner who is also the IT department. By the end you will know which attacks actually hit small shops, why two-factor sign-in with a passkey beats a six-digit code, who should have a login and what stays your job on a hosted platform. You will also know what UK GDPR asks of a shop, including how to answer a customer who wants their data or wants it deleted. Disclosure: we build Orbit Commerce, so weigh the Orbit parts accordingly. Every rule and figure was checked on 9 November 2026.

Which cyber attacks actually hit a small online shop?

The government’s Cyber Security Breaches Survey 2025/2026 (read 9 November 2026) found that 43% of UK businesses, and 42% of micro businesses, identified a breach or attack in the previous 12 months, with phishing by far the most common type at 38% of all businesses.

The email account matters most: the NCSC’s Small organisations guide to cyber security (published 9 April 2026) warns that a criminal inside it can “gain access to other accounts (for example by resetting passwords)”. Card testing, in Stripe’s guidance (read 9 November 2026), means scripts running many small payments through a checkout to find valid stolen numbers, which brings disputes, fees and a worse decline rate; watch for a spike in failed payments and tiny orders from nonsense names.

Why are passkeys better than a text message code?

Two-step verification (2SV), also called two-factor sign-in, asks for a second proof after your password: a code by text, a code from an authenticator app, or a passkey. The NCSC’s 2SV guidance calls text messages “not the most secure type of 2SV”, though any second step beats none. A code can be phished: a fake page asks for your password, then your code, and passes both to the real site within seconds.

A passkey cannot be handed over that way. It lives on your phone, laptop or password manager and is unlocked with your fingerprint, face or device PIN. On 23 April 2026 the NCSC announced that it no longer recommends passwords where passkeys are available, calling passkeys “highly resistant to phishing attacks” and at least as secure as the strongest password with two-step verification.

Add a passkey to your dashboard login and your email account first, then an authenticator app as backup, and keep the backup codes off the phone they protect. On Orbit every staff account must add a second factor within 14 days of first sign-in (a passkey, an authenticator app or a six-digit text code). Each account also gets ten single-use backup codes, and a trusted browser skips the code for 30 days. Sign-in is limited to 10 attempts a minute, a password reset follows six wrong passwords from one place, and every device is signed out when the password changes. See the security page.

Who should have a login to your shop?

Fewer than you think, and never a shared one: nobody knows who refunded the order, and the login outlives the person. The NCSC’s guide says “remove or disable the accounts you no longer use” and “review who has access to important accounts every few months”.

Give each person the least access that does the job: a packer needs orders, stock and labels, not prices or refunds. On Orbit you invite staff by email (the link lasts 7 days), they set their own password, and you pick one of seven ready-made roles or tick your own. Issue refunds and Manage product pricing are separate switches, removing someone ends their access on their next request, and every change in the activity log carries a name, kept 180 days for store activity and two years for security, role and permission events. Seats: 1 on Solo (the owner), 10 on Team, 40 on Pro, unlimited on Enterprise; see team and roles.

What does the platform secure, and what is still your job?

A hosted platform takes the server off your list; our post on the PHP2Shell flaws shows the alternative. Your phone, your laptop and your email account stay your job, and the table shows the split.

The NCSC says browser-saved passwords are fine on your own devices, never on a shared one, and that a password manager needs two-step verification of its own (NCSC, updated 21 May 2026). Forward scam emails to report@phishing.gov.uk and texts to 7726; if money has gone, report it to Report Fraud (reportfraud.police.uk) or Police Scotland (gov.uk).

What does UK GDPR actually require of a small shop?

The UK GDPR and the Data Protection Act 2018 were both amended in stages by the Data (Use and Access) Act 2025, so several ICO pages are marked under review. This is the position on 9 November 2026.

A lawful basis, written down

Decide why you may use each kind of personal data before you do, and document it; the ICO’s guide to lawful basis lists seven bases. For a shop: contract, for the details that deliver an order; legal obligation, for the records HMRC requires; legitimate interests, for fraud checks; consent, for marketing email to individuals.

A privacy notice people can read

The ICO’s right to be informed page lists what to tell people when you collect their data: who you are, what you use it for and on what basis, who you share it with, how long you keep it, their rights including complaining to the ICO, and whether the data is needed to complete the order. Since 19 June 2026, section 164A of the Data Protection Act 2018 also requires an easy way to complain to you, such as a form, and an acknowledgement within 30 days. Our privacy notice is at /privacy.

Keep it only as long as you need it

Personal data must be kept “for no longer than is necessary” (ICO). Order and payment records must stay: a limited company keeps accounting records for 6 years from the end of the financial year. A sole trader keeps Self Assessment records for at least 5 years after the 31 January deadline (gov.uk, read 9 November 2026; see sole trader or limited company). Old marketing data, notes and baskets have no such reason: set a retention period and delete on schedule.

The data protection fee

Organisations that use personal data, sole traders included, pay the ICO yearly unless exempt: £52 for a micro organisation (turnover up to £632,000 or 10 staff), £78 for a small or medium one, £3,763 above that (ICO guide to the fee, checked 9 November 2026). The exemptions apply only if everything you do is for purposes such as staff administration, your own marketing or accounts and records, so use the fee checker at ico.org.uk/fee-checker. Fixed penalties for not paying are £400, £600 and £4,000 by tier.

A breach: 72 hours

A breach is any security failure that loses, alters, discloses or locks up personal data, from a lost laptop to an export sent to the wrong customer. If a risk to people is likely, the ICO’s breaches guide says to notify it “not later than 72 hours after becoming aware of it”, and tell those affected without undue delay if the risk is high. Record every breach, reported or not.

A contract with everyone who processes data for you

Your platform, email tool and accounts software process customer data for you, and Article 28 of the UK GDPR requires a written contract with each. In practice you accept the provider’s data processing agreement; the ICO’s contracts guidance is that you stay primarily responsible, so read the agreement and keep a copy. Ours is the data processing agreement, with a sub-processor list of each provider and where it runs.

How do you answer a subject access request or an erasure request?

A request need not mention the law. The ICO says it can arrive “verbally or in writing, including by social media”, to any member of staff (ICO, updated 7 April 2026). The clock starts the day the request arrives.

An access request, step by step

1. Confirm who is asking, proportionately. A request from the account’s email address is usually enough; ask for formal identification only if necessary. The month runs from receipt, or from the day you get the identification you asked for; asking for clarification only pauses the clock (ICO).
2. Gather what you hold. Article 15 now gives the person what “a reasonable and proportionate search” turns up (backdated to 1 January 2024): the customer record, orders, payments, messages, notes and consent, plus your inbox and email tool. Delete nothing you would not otherwise have deleted.
3. Send it within one month with the supplementary information (why you hold it, who you shared it with, how long you keep it, their rights), electronically if they asked electronically, free unless the request is manifestly unfounded or excessive. A complex request can take two months more if you say why within the first month.

On Orbit, open the customer’s record and run Export customer data (GDPR): it gathers their details, orders and consents into one file for you to download, and the server copy is removed after seven days. Add anything held outside the platform and send it with a covering note; marketing consent and any unsubscribe are on the record.

An erasure request, step by step

The right to erasure is not absolute: it applies when the data is no longer needed, consent is withdrawn or the person objects to marketing, and not where you must keep the data for a legal obligation or a legal claim (Article 17). So the answer is usually: account, profile, addresses and marketing details deleted; the records the law requires kept, with personal details removed. Say so in writing within one month.

On Orbit, Erase personal data on the customer’s page does that in one pass. It first lists anything blocking the erasure (an open order or return, an active subscription, an order inside its 180-day dispute window) and makes you retype the customer’s email. It then redacts the profile, addresses and consents, anonymises their details on orders and messages, disables their login and removes the record, keeping order and payment amounts as financial records. It cannot be undone, sits behind its own permission, and your reason is kept on the activity log.

Marketing consent, and a yearly checklist

Marketing email has its own rules, the Privacy and Electronic Communications Regulations 2003 (PECR). The ICO’s rule (read 9 November 2026): no marketing email to individuals without specific consent, unless the soft opt-in applies, meaning they bought or negotiated to buy something similar from you and could opt out at the time and in every message since. Never disguise the sender, and act on every unsubscribe. Order and shipping emails are service messages until you add an offer, when the ICO treats the whole message as marketing; our post on the emails a shop sends walks that line.

Once a year

• Every account that reaches customer data has a passkey or an authenticator app, and leavers are removed.
• The privacy notice is re-read against what you now do.
• The ICO fee is paid, or the exemption recorded.
• Old marketing data, notes and baskets are deleted, and a restore from your own backup copy is tested.

Where Orbit fits

Everything attributed to Orbit above is on every plan, from Solo at £25 a month (£19 a month billed yearly, ex VAT), with a 14-day trial. That covers a second factor within 14 days by passkey, authenticator app or text code, ten backup codes, trusted browsers for 30 days, seven ready-made roles and your own with an activity log, hosting on AWS in London, a PCI DSS Level 1 certified card step, 3D Secure when the issuer asks, and erasure with the blockers checked first. Shoppers get the same protection: passkeys once you switch them on, an authenticator app under Account, Security, and a two-step reset you run from their customer record if they lose their device. See security, team and roles, customers, the DPA and sub-processor list, or pricing.

Read next: GA4 and the cookie banner under UK law and running client shops as an agency.

Questions people ask about shop security and GDPR

Do I need to pay the ICO data protection fee for a small online shop?

Probably, unless everything you do with personal data falls under an exemption such as accounts and records or your own marketing. The fee is £52 a year for a micro organisation and £78 for a small or medium one; the fixed penalty for not paying is £400 or £600. Use the ICO’s fee checker.

How long do I have to answer a subject access request?

One month from the day you receive it, or from the day you get the identification you asked for; asking for clarification only pauses the clock. A complex request can take two months more if you tell the person why within the first month. It is free in most cases.

Can a customer make me delete their order history?

Not the parts the law makes you keep. Erasure does not apply where a legal obligation requires the data, and a company keeps records of goods sold for 6 years from the end of the financial year. Delete the account and marketing details, remove personal details from the orders, keep the amounts, and say so.

Do I have to report every data breach to the ICO?

No. Report a breach likely to result in a risk to people within 72 hours of becoming aware of it, and tell those affected if the risk is high. A breach unlikely to cause a risk need not be reported, but you must still record what happened and what you did.

Are passkeys safer than a text message code?

Yes. A code can be phished by a fake sign-in page that passes it to the real site; a passkey is unlocked on your device with a fingerprint, face or PIN and cannot be handed to a fake page. On 23 April 2026 the NCSC said it no longer recommends passwords where passkeys are available.

The 14-day free trial, no card required, is long enough to add a passkey, invite a helper with a role and run a test erasure on a dummy customer.