A data policy is a collection of data points that Elastic Path Commerce stores for a specific customer. You can use data policies to maintain compliance with data protection laws. CMS use data policies to manage consents of customers to use their data. With data policies, customer can change the permission settings for data point values at any time. However, you can also define a data policy with no data points. A data policy with no data points enables collection of consent for data points that are not in Elastic Path Commerce. For example, a data policy for collecting banking details might be maintained in an external system, but the consent is managed by a data policy in Elastic Path Commerce.

Defining the legal description of the data policy, implementation of the data policy, and presenting the data policies to customers are done by the CMS. Elastic Path Commerce only manages the data points in a data policy, logical implementation of the data policy, and the customer consents. A data policy comprises of the following information: