First-party data in retail

‍What you may do, what you should do, and what to avoid

Collecting and using data without violating data protection laws: that is not a contradiction. This article explains what first-party data is, why it is becoming more important for retail and how to collect and use it in compliance with the GDPR.

Note: This article provides guidance but does not replace legal advice. For specific questions, consult your data protection officer or a specialized lawyer.

What is first-party data?

First-party data is data you collect yourself – directly, first-hand, within your own customer relationship. That distinguishes it from second-party data, which a partner collects and shares with you, and from third-party data, which third parties collect and sell.

Data types at a glance:

First-party data: collected yourself, directly from the customer

Examples: purchase history, newsletter sign-ups

Second-party data: collected and shared by a partner

Examples: data from cooperation partners

Third-party data: bought from third parties, origin unclear

Examples: address brokers, cookie data

In retail, typical first-party data includes: transaction data from the POS system, loyalty card information, newsletter sign-ups, app usage data, loyalty program registrations and contact details from complaints or inquiries.

Why first-party data is becoming more important now

The advertising and marketing world is changing. Third-party cookies, for years the foundation of personalized online advertising, are being blocked by browsers. Apple has heavily restricted tracking on iOS. The GDPR makes handling third-party data complicated and risky.

The consequence: those who rely on other people's data lose their foundation. Those who collect their own data keep control. First-party data is the new gold – because it belongs to you, because you know where it comes from and because you can use it with legal certainty.

For brick-and-mortar retail, this is an opportunity. You have direct customer contact. You see real buying behavior. You can collect data that online retailers can only guess at. The question is: are you making use of this position?

What is allowed: the legal bases

The GDPR does not prohibit collecting data. It requires that there is a legal basis and that data subjects are informed. Four legal bases are relevant for retail.

1. Contract performance (Art. 6(1)(b) GDPR)

Data you need to fulfill a contract may be processed without additional consent. In retail, this means you may store transaction data because it is part of the purchase contract. You may use delivery addresses to deliver the goods.

Example: A customer buys a television with delivery. You may store the name, address and purchase details and use them for the delivery. No consent required.

2. Legitimate interest (Art. 6(1)(f) GDPR)

If you have a legitimate interest and the customer's interests do not outweigh it, you may process data. This is the most flexible but also the most demanding basis. You must document why your interest is legitimate and why it does not override the customer's interests.

Example: Aggregated market basket analyses for assortment optimization are generally covered by legitimate interest, as long as no personal profiles are created.

3. Consent (Art. 6(1)(a) GDPR)

The classic basis for marketing: the customer actively agrees. Consent must be freely given, informed, specific and unambiguous. Pre-ticked boxes do not count. Consent can be withdrawn at any time.

Example: Newsletter sign-up with double opt-in. The customer enters their email address, confirms the link in the confirmation email, done.

4. Legal obligation (Art. 6(1)(c) GDPR)

Some data must be stored because the law requires it. Tax-relevant receipts must be retained. Here, storing data is not just a right but an obligation.

Example: Invoice data must be kept for ten years – tax law demands it. That is not a GDPR violation but a legal obligation.

5 dos: what you should do

✓ DO 1: Create transparency

Inform customers clearly and understandably about which data you collect and what for. This builds trust and is legally required.

✓ DO 2: Respect purpose limitation

Use data only for the purpose for which it was collected. Newsletter addresses are for newsletters, not for cold calling.

✓ DO 3: Practice data minimization

Collect only what you really need. A date of birth for a newsletter sign-up? Unnecessary, so do not ask for it.

✓ DO 4: Document consents

Record when and how the customer gave consent. In a dispute, you must be able to prove it.

✓ DO 5: Implement a deletion policy

Define when data is deleted and automate the process. Hoarding data just in case is not allowed.

5 don’ts: what to avoid

✗ DON’T 1: Buy data

Third-party data is a legal minefield. You do not know how it was collected. Hands off.

✗ DON’T 2: Assume implied consent

Saying nothing is not consent. Pre-ticked boxes are not consent. Opt-out procedures are not GDPR-compliant.

✗ DON’T 3: Share data without a legal basis

Even with partners, you may only share customer data if there is a legal basis – usually the customer's consent.

✗ DON’T 4: Track without informing

Even on your own website or in your own app, you must inform users about tracking and, in many cases, obtain consent.

✗ DON’T 5: Ignore access requests

Customers have the right to know what data you hold about them. Do not ignore such requests – it can get expensive.

Obtaining consent the right way

Consent is the gold standard: if the customer gives informed consent, almost anything is possible. But the requirements are strict.

Freely given: the customer must not suffer any disadvantage for declining. The purchase must not depend on signing up for the newsletter.

Informed: the customer must know what they are consenting to. Vague wording such as “for marketing purposes” is not enough.

Specific: different purposes require different consents. Newsletters and profiling are not the same thing.

Unambiguous: an active action is required. Ticking a box, clicking a button, submitting a form.

Revocable: withdrawing consent must be as easy as giving it. An unsubscribe link in every email, one click in the settings.

Anonymization vs. pseudonymization

Anonymization: no link to an individual person is possible. The GDPR does not apply.

Pseudonymization: identification is possible with additional information. The GDPR still applies.

In practice, this means: if you run market basket analyses that cannot be traced back to individual customers, you are working with anonymized data. The GDPR does not apply in that case. But if you carry a customer ID along – even if you never see the name – the data is only pseudonymized and the GDPR continues to apply.

Practical implementation in retail

Transaction data

POS data without personal identifiers can be analyzed freely. Basket sizes, peak times, product affinities – all of this is unproblematic as long as no customer ID is attached. With a loyalty card, the data becomes personal. Then you need a legal basis, typically legitimate interest or the consent given when signing up for the loyalty program.

Digital receipts

The digital receipt is an elegant touchpoint. The customer actively provides their email address or phone number to receive the receipt. That is a clear action that counts as consent for delivering the receipt. For any use beyond that, such as marketing, you need separate, explicit consent.

Loyalty cards and loyalty programs

When customers sign up for a loyalty program, you can obtain far-reaching consents. The customer receives a benefit – points, discounts, exclusive offers – and you receive permission to analyze their buying behavior. Important: the consent must be specific. Which data is collected? What happens to it? How long is it stored?

Compliance checklist

Check these points:

☐ Privacy policy is up to date and complete

☐ Record of processing activities is maintained

☐ Consents are documented and verifiable

☐ Deletion periods are defined and observed

☐ Data processing agreements are in place

☐ Data protection officer is appointed (if required)

☐ Process for access requests is established

☐ Employees are trained

Conclusion: data protection as a competitive advantage

Data protection is not a brake – it is a mark of quality. Retailers who collect customer data cleanly and use it transparently build trust. Trust is the basis for sharing data: the more customers trust you, the more willing they are to share information with you.

The future belongs to first-party data. Those who build it up in a GDPR-compliant way today will have a competitive advantage tomorrow. Those who rely on third-party data will soon be left without a foundation.

Data-driven and privacy-compliant: that is not a contradiction. It is the only sustainable strategy.