I've inherited a site which sells digital products (videos) using paypal. The cart and checkout pages are not currently served over SSL. The business is UK based but the servers are in the US.

Aside from security concerns (I realise these pages should be served over https), is this actually a legal requirement in the UK and / or USA?

  • 2
    No, its not... But safe guarding your customers data falls under local data protection acts. Not taking reasonable steps to safe guard your customers data is 1. stupid and 2. can be found liable for damages. Mar 20, 2015 at 9:39
  • It is not in the U.S. but it might as well be. Certificates have been standard practice for so long that I am amazed that someone had an e-commerce site without a certificate. I would be setting one up right away!! How many people ran away before buying because you do not have a certificate?? You will never know. But I will bet it is a lot!
    – closetnoc
    Mar 20, 2015 at 12:43

1 Answer 1


If the payments are totally handled by paypal then they are taking care of this for you. See this info on PCI DSS compliance


However if you are additionally taking and storing customer details you have additional obligations under the data protection act.

Here is a good roundup...


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.