Install freeEvery data subject request, handled in one place
Give customers a page to ask for their data, correct it or erase it. Pandectes checks that each request comes from a real customer, verifies guests by email, and lists every request with its status, so you answer on time and keep the record.
What is a data subject access request (DSAR)?
A data subject access request (DSAR) is a person asking a business what personal data it holds about them, under Article 15 of the GDPR. The GDPR also gives customers the right to receive their data in a portable format, to have it corrected and to have it erased, and the CCPA gives Californians similar rights. As the store owner you are the data controller: you must answer each request, normally within one month.
Four rights, one request page
- Art. 15
Access
The customer asks what you hold about them. You send a copy of their customer and order data.
- Art. 20
Portability
The customer asks for their data in a machine-readable file they can take elsewhere.
- Art. 16
Rectification
The customer describes what to correct. You update their profile and mark the request done.
- Art. 17
Erasure
The right to be forgotten. You erase their personal data from the Shopify admin in one click.
Where customers make a request
Add a request page to your store, and to Shopify customer accounts. Every request lands in the same dashboard.
- A page on your storefront Add the Pandectes Data Requests section to a page and link it in your footer. Signed-in customers send a request in one click; guests enter their email.
- The Privacy Center in customer accounts Signed-in customers see their cookie consent and every request they sent, start a new one, or cancel it.
Only real customers, verified
Pandectes checks every request against your Shopify customers before it reaches you. A guest confirms by email, and a request that isn’t confirmed is marked unverified, so you never send data to the wrong person.
- Requests only from customers with an account or an order
- Email verification for guests
- Status, request date and fulfilment date for each one
Emails in your words
Customers hear from you at every step, and you get an email for every new request. Edit each email with Liquid variables, preview it on desktop and mobile, and send yourself a test.
- Guest verification
- Data portability
- Data rectification
- Data erasure
How it works
The customer sends a request
From your request page or their account, they choose access, export, correction or erasure.
The request is verified
Guests confirm by email. You and the customer are both notified.
You fulfil it and mark it done
Export, edit or erase the customer in Shopify, and the customer gets a confirmation.
Data subject request questions, answered
How long do I have to answer a DSAR?
Under the GDPR, one month from the request, and in most cases you can’t charge a fee. Under the CCPA the deadline is 45 days. Pandectes shows when each request was made and whether it has been fulfilled, so nothing slips.
Which requests can customers make?
Access to their data, a portable export of it, a correction, or erasure (the right to be forgotten). Each one reaches your Customer data requests dashboard with its type and status.
Can guests make a request?
Yes, if they have an account or have placed an order. Turn on Support guest visitors; a guest enters their email and confirms the request from the email they receive. Someone who has never bought or registered has no data in your store, so there is nothing to export or erase.
How do I erase a customer’s data?
Open the request, go to the customer in your Shopify admin and choose Erase personal data. Then mark the request as fulfilled and let the customer know. See how to handle GDPR data requests on Shopify for every request type, step by step.
Does Pandectes store my customers’ personal data?
No. The data comes straight from the Shopify API, the emails the app sends carry no personal information, and everything the app stores for your store is deleted 30 days after you uninstall it.
Where should the request page be?
Somewhere customers can find it, usually your footer menu next to your privacy policy. If your store uses the new Shopify customer accounts, add the Privacy Center there too.
Why merchants choose Pandectes
Privacy compliance that installs in minutes, keeps your store fast and grows with you.
- 185k+
- stores installed Pandectes
- 3,000+
- five-star reviews
- 17m+
- consents recorded every day
- 35
- privacy laws covered
Loved by Shopify merchants
Built for Shopify, and one of the most installed and highest-rated privacy apps in the Shopify App Store.
3,000+Fast at any scale
From a first store to millions of visitors a day, with no slowdown for your shoppers.
Every privacy law
GDPR, CCPA/CPRA, LGPD, PIPEDA, APPI and 30 more, with the right banner for each region.
A global cookie dictionary
Every cookie on your store is matched to our database and categorised for you.
Proof of consent
A downloadable record of every consent, ready if a regulator asks.
Real people, 24/7
Our team answers by chat and email around the clock.
Make your Shopify Store's use of cookies and online tracking compliant today
Try for freeRecent Posts
How HB 380 Changes Delaware Privacy Compliance in 2027
Delaware's HB 380 rewrites the state privacy law from January 1, 2027: lower thresholds, more sensitive data, stricter consent, teen protections and named third-party disclosures.
Website Compliance Under the Louisiana Data Privacy Act
The Louisiana Data Privacy Act takes effect on January 1, 2027. Who it applies to, the consumer rights and opt-outs websites must support, notices, assessments and penalties.
Google's EU User Consent Policy Audit: The 8 Checks and How to Pass Them
Google is auditing consent on sites that advertise in Europe. The 8 issues it flags, how to fix each one on Shopify, and what agencies managing client accounts need to do.