How to Handle GDPR Data Requests on Shopify, Step by Step

A customer emails your store and asks for a copy of everything you hold about them, or asks you to delete it. Under the General Data Protection Regulation (GDPR), that is a data subject request, and you have one month to answer it.

Shopify gives you the tools for the part of the data it holds: in Shopify admin, open the customer, then use More actions › Request customer data to export their data, or More actions › Erase personal data to erase it. The rest is up to you: confirming who is asking, collecting the data your apps hold, and answering on time. This guide walks through each step.

The short answer: to handle a GDPR data request on Shopify, verify the customer’s identity, export or erase their data from their customer profile in Shopify admin, do the same in every app that holds a copy, reply within one month, and keep a record of what you did.

What counts as a GDPR data request

Customers in the European Economic Area (EEA), the UK and Switzerland have the right to control their personal data. A request can arrive by email, through a contact form, in a chat or on a request page. It does not need to use legal words to count. Shopify calls these customer data requests; under the GDPR they are data subject requests (DSRs), or data subject access requests (DSARs) when the customer asks for a copy of their data.

The customer asks to	The right	What you do on Shopify
See or get a copy of their data	Right of access	Request customer data, plus the data in your apps
Fix wrong details	Right to rectification	Edit the customer profile and the same record in your apps
Delete their data	Right to erasure	Erase personal data, plus deletion in your apps
Receive their data to move it elsewhere	Right to data portability	Send the export in a common, machine-readable format
Stop marketing	Right to object	Unsubscribe them in Shopify and your email or SMS apps
Pause the use of their data	Right to restriction	Stop processing it while you check their complaint

The deadline, and what you can ask for

You must respond within one month of receiving the request. For complex or numerous requests you can extend that by two further months, as long as you tell the customer within the first month and explain why (Article 12(3) GDPR). The clock starts when the request arrives, not when you notice it, so check your inboxes and forms regularly.

Three more rules from the same article:

• It is free. You cannot charge for a first request. You can charge a reasonable fee, or refuse, only when requests are clearly unfounded or excessive, for example repeated requests for the same data.
• You can verify identity. If you have reasonable doubts about who is asking, ask for information that confirms it before you release or delete anything.
• Answer in plain language, by the same channel the customer used where possible.

How to handle a data request in Shopify admin

1. Verify the customer’s identity

Sending someone else’s order history to the wrong person is a data breach. Confirm the request comes from the account holder: reply from your store email to the address on the customer profile, and ask them to confirm. Do not ask for more than you need. A copy of a passport is rarely necessary for a store.

2. Export the customer’s data from Shopify

In Shopify admin, go to Customers, open the customer’s profile, then choose More actions › Request customer data. Shopify prepares the data it processes about the customer’s visits to your store. Refresh the profile page to see it, and Shopify also emails it to the store owner (Shopify Help Center).

3. Collect the data your apps hold

Shopify’s export covers the data Shopify processes. Your apps keep their own copies, and those count too. Check every app that stores customer data, such as:

• email and SMS marketing
• reviews and loyalty programs
• help desk and live chat
• subscriptions, upsells and wishlists
• analytics or customer data platforms

Export the customer’s data from each, or ask the app’s support team for it.

4. Send the data to the customer securely

Combine the exports and send them in a common format, such as a PDF for reading and a CSV or JSON file for moving to another service. Send it only to the verified email address. For sensitive data, use a password-protected file and share the password separately.

5. Erase the customer’s personal data

For an erasure request, go to Customers, open the customer’s profile, then choose More actions › Erase personal data. Shopify processes the erasure for you, so you don’t need to contact support. Keep in mind:

• Order details stay. Shopify erases personal details such as name and address, but keeps order details such as what was sold and when, which you may need for tax records.
• You have 10 days to cancel. Open the profile and click Cancel request in the Erasure request submitted section.
• Subscriptions end. For customers with pre-orders or subscriptions, remaining payments aren’t charged and subscription contracts are canceled.
• Installed apps and channels are included. The erasure request also applies to the apps and sales channels installed on your store, which receive the request from Shopify.
• Other services are on you. Contact any other company you shared the customer’s data with, and delete it from tools that are not connected to Shopify, such as spreadsheets or a separate help desk.

Erasing personal data is not the same as deleting a customer profile. Deleting removes the whole profile, while erasure removes the personal data in a way that meets the request.

6. Correct inaccurate data

For a correction request, edit the details on the customer’s profile in Shopify admin, then update the same record in any app that keeps its own copy.

7. Keep a record

Log each request: who asked, what they asked for, when it arrived, how you verified them, what you did and when you replied. If a customer complains to a data protection authority, this log is your evidence that you handled the request properly. Keep the log itself free of the data you erased.

What you can keep after an erasure request

The right to erasure is not absolute. You can keep data you need to comply with a legal obligation or to defend a legal claim (Article 17(3) GDPR). For most stores that means invoices and order records required for tax, for as long as tax law requires. Tell the customer what you kept and why.

Requests that reach Shopify directly

Customers can also send an erasure request to Shopify itself, through the Shop app’s account settings or the Shopify privacy portal. Data Shopify receives through Shop and Shop Pay is handled by Shopify, not by your erasure request, so a customer who wants that data removed should use those channels.

Give customers one place to make requests

A request page saves you from hunting through inboxes, and makes sure every request is verified and tracked against its deadline. Pandectes GDPR Compliance adds a customer data requests page to your Shopify store on every plan, including the free one:

• Customers make the request themselves from a page on your store, or from a block in their customer account.
• Requests are verified by email before you see them, so you know the request is genuine.
• You and the customer are notified at each step, with email templates you can edit.
• Guest customers who never created an account can make requests too.
• Every request is listed with its status, so nothing misses the one-month deadline.

Pandectes is the most reviewed GDPR app on the Shopify App Store, rated 5.0 from more than 3,000 reviews. For the rest of your store’s GDPR setup, from the cookie banner to Google Consent Mode, see our Shopify GDPR compliance guide.

Frequently asked questions

This guide is general information, not legal advice. For decisions about your store, speak to a qualified privacy lawyer.