Digital receipts and UK GDPR: what a shop needs to know
The moment a customer gives you an email address to receive their receipt, you are processing personal data and UK GDPR applies. That sounds heavier than it is. A shop sending digital receipts has a small, well-understood set of obligations, and most of them can be met by choosing a sensible provider and not doing anything silly with the list afterwards. This is a plain-English summary rather than legal advice.
Who is responsible for what
You, the shop, are the controller: it's your customer and your decision to offer digital receipts. Whoever sends the receipt on your behalf is a processor, and the law says there must be a written contract between you, covering what the processor may do with the data. With TapReceipt that contract is our Data Processing Agreement, which you accept with the Terms; with any other provider, ask to see theirs. If a provider can't produce one, that's your answer.
What you're allowed to do with the email
Send the receipt. The customer asked for it, so sending it is part of the transaction. You don't need a separate consent box for that.
Remember them for next time, if they ask. Letting the customer choose to have their device remembered so later receipts are automatic is fine, provided it's their choice and they can undo it.
Marketing is different. An email address collected for a receipt cannot simply be added to your newsletter. Marketing emails to individuals fall under PECR as well as GDPR, and the safe route for a shop is a clear, unticked opt-in at the point the email is collected, recorded so you can show it later. There is a narrower "soft opt-in" exception for existing customers, but it has conditions, and a receipt system that records explicit consent per shop is simpler to defend. That's how TapReceipt does it: the opt-in is separate, unticked, and logged.
What customers can ask you for
Under UK GDPR a customer can ask to see what you hold on them, have it corrected, have it deleted, or stop you contacting them. You have a month to respond. In practice, for a receipt system, this means your provider needs a way for the customer to view and delete their own data without you having to dig through anything. Ours is the Settings link on every receipt; the customer can export or erase their data themselves, which handles most requests before they reach you.
How long to keep it
Keep personal data only as long as you need it. The receipt itself is an accounting record, so the transaction has to be kept for the statutory period, but the customer's email doesn't need to stay attached to it. A good system separates the two: transaction data retained and anonymised, personal identifiers removed on a schedule. Ask your provider what their retention periods are; if they can't tell you, they haven't thought about it. Ours are set out in the privacy policy.
Where the data lives
Data stored in the UK or the EU is straightforward. Data processed outside those, which includes most US email services, needs a recognised transfer mechanism such as the UK's International Data Transfer Agreement or the EU standard clauses with the UK addendum. You don't need to understand these, but your provider does, and their privacy policy should name every company that touches the data and where it is. If it doesn't, ask.
The mistakes that actually cause problems
Almost every receipt-data complaint comes from one of three things: marketing to people who only wanted a receipt; keeping emails forever; or a staff member exporting the list to a spreadsheet that then goes missing. None of these needs a lawyer to prevent. Separate consent, a retention schedule, and a dashboard that doesn't make exporting the whole list a one-click job will cover a small shop comfortably.
If you'd like to check how we handle any of this, the privacy policy, DPA and FAQ are written to be read by shop owners, not solicitors.