Hacker News Reader

They were not. Someone just searched for all excel files with personal information on their thousand+ websites and found hundreds of examples with names, addresses and phone numbers of ordinary citizens.

I don't think you really understand GDPR if you think that you can just "store" the information and be compliant.

It's not only about what data you store.

It's about how the data is stored and who has and can get access to it.

The fact that they stored it in excel files is already a big red flag.

Quite a lot more permanent than you would imagine, say a purchase goes wrong and there is a fraud investigation etc. so most countries have laws that require such shops to have the info for at least a year or two.

Yes, but you don't store it in plain text using excel files.