Handling GDPR Customer Data Requests on Shopify

A customer emails: “Please send me all the data you hold about me”, or “Please delete my data”. Under the GDPR you have to act on that, and Shopify gives you tools for both. Those tools reach Shopify and the apps that listen for privacy events. They do not reach your spreadsheets, your helpdesk, or a custom integration that was never built to handle them.

This guide covers the Shopify side step by step, the timelines Shopify documents, what apps receive, and what a custom app or integration has to do so a request is handled everywhere your customer’s data lives.

This is general information, not legal advice. Shopify’s own help pages say the same about their GDPR content: it’s your responsibility to understand your obligations.

What the GDPR asks of you

Two rights come up most in a Shopify store:

• Access (Article 15): the customer can ask what personal data you hold about them and get a copy.
• Erasure (Article 17): the customer can ask you to delete their personal data.

Article 12(3) of the GDPR sets the timing: you respond “without undue delay and in any event within one month of receipt of the request”. You can extend by two further months for complex or numerous requests, but you must tell the person within the first month and give the reasons.

Erasure has exceptions. Article 17(3)(b) says the right does not apply where processing is necessary “for compliance with a legal obligation” under EU or Member State law. Record-keeping rules for tax and accounting can be such an obligation, which is one reason an erased customer’s orders may still need to exist in your books.

Step 1: Confirm who is asking

Shopify’s help page on processing customer data requests says you may need to verify the customer’s identity before sharing data. Do this before anything else. Sending someone’s order history to the wrong person can itself be a personal data breach.

A practical check is to reply only to the email address on the customer’s account, or ask the customer to confirm details only they would know, such as a recent order number.

Step 2: Handle an access request in Shopify

1. In the Shopify admin, go to Customers and open the customer’s profile.
2. Click More actions > Request customer data.
3. Refresh the customer’s profile page to access the data.

Shopify says that if you are the store owner, the data is also sent to your email. Share it with the customer only once you have decided it is legally required or consistent with your store’s policies.

That covers what Shopify holds. Apps installed on your store that have access to customer or order data receive a customers/data_request webhook (see below) and are expected to give you their part directly. Data in tools Shopify doesn’t connect to, such as an email platform, a helpdesk or exported spreadsheets, you collect yourself.

Step 3: Handle an erasure request in Shopify

1. Open the customer’s profile.
2. Click More actions > Erase personal data.

Shopify then processes the request for you. According to its help page:

• Shopify erases personal data such as the customer’s name and address.
• Information such as what was sold and the date and time of the sale stays visible in your admin.
• For customers with pre-orders or subscriptions, remaining payments aren’t charged and subscription contracts are cancelled.
• You have 10 days to cancel the request, from the “Erasure request submitted” section of the profile.
• The request also covers apps and channels you installed from your Shopify admin.
• “It’s your responsibility to contact any other companies that you’ve shared the customer’s personal data with.”

Erasing personal data is not the same as deleting a customer profile. Erasure redacts personal information and keeps the order history. Deleting removes the profile.

Requests from Shop and Shop Pay users

Shopify says erasing data in your admin doesn’t erase what Shopify holds from the customer’s own relationship with Shopify through Shop and Shop Pay. Those customers can use the Shop app’s account settings or Shopify’s privacy portal at privacy.shopify.com.

Erasing all customers when you close a store

Shopify’s page on deleting data explains that the personal data of all your customers can only be erased from a deactivated store, and only the store owner can request it from Shopify Support. The data is erased within 14 days after the request is completed.

The timelines Shopify documents

Event	Timeline
Cancelling an erasure request in the admin	Within 10 days
customers/redact sent to apps	10 days after the request if the customer hasn’t ordered in the past six months; otherwise held until six months have passed
shop/redact sent to an app	48 hours after the store uninstalls the app
App completes a compliance request	Within 30 days of receiving it
Erasing all customer data of a deactivated store	Within 14 days after the request is completed

The six-month hold on customers/redact comes from Shopify’s privacy law compliance documentation for developers. Keep it in mind when you answer the customer: an app may only receive the deletion instruction months after you clicked the button.

What apps receive

Shopify sends three compliance webhooks. Its developer docs list them and their payloads:

Webhook	When	Payload	What the app must do
customers/data_request	A customer requests their data from a store owner	shop_id, shop_domain, orders_requested, customer (id, email, phone), data_request (id)	Provide the requested data to the store owner directly
customers/redact	A store owner requests deletion of a customer’s data	shop_id, shop_domain, customer (id, email, phone), orders_to_redact	Delete or redact that data
shop/redact	48 hours after the store uninstalls the app	shop_id, shop_domain	Erase the store’s data

The first two go to apps installed on that store that have access to customer or order data. Apps must answer each webhook with a 200-series status, reject requests with an invalid HMAC header with 401 Unauthorized, and complete the action within 30 days. Shopify adds one exception: don’t complete a redaction if you are legally required to keep the data.

Apps distributed through the Shopify App Store must subscribe to all three. Shopify’s webhook setup guide labels them “Mandatory compliance topic for public apps only”.

Where requests get lost

A request handled in the Shopify admin can still miss data in four places:

1. A custom app that doesn’t subscribe. Webhooks only reach apps subscribed to them. Shopify makes these topics mandatory for public apps, so a custom app built for your store may never have been set up to listen. If it stores customer names, emails or addresses in its own database, that copy stays.
2. Integrations that sync data out. An ERP, a 3PL, an email marketing tool or a helpdesk holds its own copy. Shopify tells you to contact these companies yourself.
3. Files. Order exports emailed to colleagues or saved to shared drives contain names, emails and addresses.
4. Shopify Flow emails. Workflows that email order details put personal data in inboxes.

What a custom app or integration must do

If you run a custom app or integration that stores customer data, it needs the same three behaviours as a public app. Whether it listens to Shopify’s webhooks or follows a manual runbook is a design choice; ignoring requests is not.

1. Know what you store

Write a short data map: which tables or systems hold customer IDs, emails, phone numbers, addresses, order references, notes, files and logs. Without it, nobody can answer an access request completely.

2. Handle access requests

When a customers/data_request arrives, or when you handle one by hand, collect everything the app holds for that customer ID, email or phone and the listed orders, and give it to the store owner in a readable format. The store owner decides what goes to the customer.

3. Handle erasure

On customers/redact, delete or anonymise the listed customer and orders. Keep only what you must keep by law, and document why. Make the handler idempotent: the same request may arrive twice.

4. Handle uninstall

On shop/redact, erase the store’s data, including backups on whatever schedule your backup policy allows.

5. Build the webhook endpoint properly

• Accept POST requests with a JSON body.
• Verify the HMAC header and return 401 if it fails.
• Return a 200-series response quickly, then do the work in a background job.
• Log the request ID, the action taken and the date, without logging the personal data itself.
• Alert someone if a job fails, so the 30-day window doesn’t pass unnoticed.

Our integrations checklist covers HMAC checks, retries and duplicate deliveries in more detail.

6. Trigger erasure from your own tools

If requests reach you through a helpdesk or form rather than the Shopify admin, a custom tool can start the Shopify erasure itself. The Admin GraphQL API has a customerRequestDataErasure mutation that “enqueues a request to erase customer’s data”. It needs the write_customer_data_erasure scope, and the acting user needs permission to erase customer data. A customerCancelDataErasure mutation cancels it.

A routine for every request

1. Log the request with the date received. The one-month clock starts there.
2. Verify the requester’s identity.
3. Access: request customer data in Shopify, collect what apps send you, and add data from other tools.
4. Erasure: erase personal data in Shopify, then work through your data map for systems Shopify doesn’t reach.
5. Check whether any data must be kept for legal reasons, and note which.
6. Reply to the customer within the deadline, saying what you did.
7. Keep a record of the request and your reply, without copying the data itself.

FAQ

How long do I have to respond to a GDPR request?

The GDPR says without undue delay and within one month of receiving the request, extendable by two further months for complex or numerous requests if you tell the customer within the first month.

Does “Erase personal data” in Shopify delete the customer’s orders?

No. Shopify erases personal data such as the name and address. What was sold and when stays in your admin.

Do apps delete the customer’s data automatically?

Apps with access to customer or order data receive a customers/redact webhook and must act within 30 days. If the customer ordered in the past six months, Shopify holds the webhook until six months have passed. If you need confirmation that an app has deleted the data, ask its developer.

Do custom apps receive the compliance webhooks?

Shopify makes them mandatory for public apps. A custom app only receives them if it subscribes. Check with whoever built it; if it stores customer data and doesn’t listen, you need another way to handle requests for it.

If your custom app wasn’t built for this

Adding compliance handling to an existing custom app usually means a data map, three webhook handlers and a background job, not a rebuild. If no one on your side owns the app any more, see how to maintain a custom Shopify app and custom app or public app. Our custom solutions page describes the custom apps and integrations the team behind Storefleet Store Ops takes on.