When a customer in Europe asks to see or delete their data, you are required to respond. Shopify provides tools to help you process these General Data Protection Regulation (GDPR) requests directly from the admin for the data Shopify holds, but you remain responsible for handling the request and addressing data stored elsewhere (The page on gdpr).
Key takeaways
- You are the data controller and are responsible for responding to your customers' data requests.
- The GDPR gives you one month to respond to a data access or erasure request.
- Shopify has built-in tools in the
Customerssection of the admin to export or erase a customer's personal data (The page on processing customer data requests). - A data request applies to all personal data you hold, including copies in third-party apps like email marketing or loyalty programs.
What is a GDPR data request?
A GDPR data request, also known as a Data Subject Request (DSR) or Data Subject Access Request (DSAR), is a formal inquiry from an individual to exercise their rights over their personal data. Under the GDPR, people have several rights, including the right to access a copy of their personal data, correct inaccuracies, and request its deletion, also known as the "right to erasure". As a Shopify merchant, you are considered a data controller for your customers' information, which means you are legally obligated to fulfill these requests (The page on gdpr).
If a customer emails asking for "a copy of all my data" or "for you to delete my account information," it should be treated as a formal data request. These rights apply to individuals in the European Economic Area (EEA), the UK, and Switzerland (The page on gdpr).
How long do I have to respond to a request?
According to Gdpr Info, you must respond to a data subject request without undue delay, and at the latest within one month of receiving it. This one-month clock starts the day you receive the request, not when you first read it or begin processing it.
In certain situations, such as when a request is particularly complex or you have received multiple requests from the same person, the deadline may be extended. According to Gdpr Info, if you need to use an extension, you must inform the individual within the first month and explain why the delay is necessary.
How to process a GDPR request in Shopify
When a customer asks to see or delete their data, you can use Shopify's tools to process the request for data stored on the Shopify platform.
- Go to
Customersin your Shopify admin, which opens the customer list. - Select the customer who made the request, which opens their profile.
- Click
More actionsand chooseRequest customer datato export their data, or chooseErase personal datato begin the erasure process.
Common mistakes to avoid
Handling data requests requires careful attention to detail. A mistake can lead to a compliance failure and damage customer trust.
- Forgetting about app data: A frequent error is assuming Shopify's tools cover everything. Customer data is often spread across many systems, and you are responsible for all of it (The page on gdpr). Make a list of all apps and services that handle customer data and create a process for contacting them for every request.
- Missing the deadline: The one-month response window is strict. It is important to have a system for identifying and logging requests as soon as they arrive.
- Failing to verify identity: Giving personal data to the wrong person is a serious data breach. Always take steps to verify the identity of the person making the request before sending any information.
- Providing incomplete information. An access request requires you to provide a range of information, including processing purposes, data categories, and recipients of the data. exporting the data might not be enough to fulfill the request completely.
A worked example
Here is how a typical data access request might play out.
Example: A customer named Sarah, who lives in France, sends an email to your support address asking for a copy of all the personal data your store has about her.
Your team sees the email and identifies it as a GDPR data subject request. The one-month clock starts now. You reply to Sarah to acknowledge receipt and state you are processing her request. You might ask for a recent order number to help verify her identity.
Next, you log into your Shopify admin, go to her customer profile, and use the "Request customer data" function (The page on processing customer data requests). While Shopify prepares its export, you check your list of third-party apps and see that you use an email marketing app and a reviews app. You log into both services and use their export functions to get a copy of Sarah's data.
Once you receive the data files from Shopify and your apps, you combine them into a single package and send them to Sarah securely via email. You log the date the request was completed, well within the one-month deadline.
This is general information, not legal advice. You should consult your own legal counsel to determine how data protection laws might affect your business (The page on gdpr).
Frequently asked questions
Does Shopify automatically handle GDPR requests for me?
No. While Shopify provides tools to access and erase the data on its platform, you, the merchant, are the data controller and are responsible for receiving the request from your customer, carrying out the steps, and ensuring data in third-party apps is also handled (The page on gdpr).
What happens when I erase a customer's data in Shopify?
When you request to erase a customer's data, Shopify processes the request for data stored on its platform. You must also follow up with each app developer to ensure they comply with the erasure request, as you are responsible for data held in third-party systems (The page on gdpr).
Is there a fee for responding to a data request?
Generally, you must provide the information free of charge. According to Gdpr Info, the GDPR only allows for a reasonable fee to be charged if a request is "unjustified or excessive," or if the individual requests additional copies.
Can I refuse a data request?
You can only refuse to comply with a request if it is clearly unfounded or excessive. According to Gdpr Info, if you refuse a request, you must inform the individual of the reason why and let them know they have the right to complain to a supervisory authority.
Read next
