GDPR for Shopify Stores: A Practical Setup Guide

Who it is for

UK and EU store owners

Time needed

An afternoon for the initial setup

What you need

Admin access and a list of your apps

For a Shopify store, GDPR comes down to five jobs: tell people what you collect and why, only use their data for marketing when they've agreed, keep it safe, answer their requests on time, and know what your apps do with it. Shopify gives you tools for most of these. None of them switch on by themselves in the right way.

This guide goes through each job with the Shopify admin steps, for UK stores under UK GDPR and stores selling to the EU under the EU GDPR. Shopify's settings come from its Help Center, and the rules from GOV.UK and the European Commission, all as checked on 7 November 2026.

Who is responsible for what

GDPR splits responsibility between the controller, who decides why and how data is used, and the processor, who handles it on the controller's behalf. For your customers' data, you're the controller and Shopify is the processor under its Data Processing Addendum. If you turn on Shopify's Enhanced Services, such as Shopify Network Intelligence, Shopify takes on a controller role for that data, and extra disclosure rules apply.

GDPR doesn't require customer data to be stored in Europe. Transfers of European residents' data outside Europe must be protected under the law, which Shopify covers in its own data transfer terms. Your apps are a separate question, and the main one most stores overlook.

Step 1: Write a privacy policy that fits your store

1. Open the policy. Go to Settings > Customer privacy > Privacy policy.
2. Choose automated or manual. Use automated policy keeps the text in line with your store settings. Writing it yourself gives you full control but you have to keep it updated.
3. Add your legal bases. For each purpose, such as processing orders, sending marketing or running analytics, say which legal basis you rely on: contract, consent, legitimate interests or a legal obligation. Shopify doesn't automate this for UK, EEA or Swiss stores.
4. Add contact details. Include your data protection officer if you have one. If you have no establishment in the UK, EEA or Switzerland, add your representative's details.
5. List your apps and processors. Name the types of service you share data with: email marketing, reviews, shipping, payments, analytics. If you use Shopify Network Intelligence, link to Shopify's Consumer Privacy Policy and to privacy.shopify.com.
6. Make it findable. Link the policy in your footer and at checkout, and review it whenever you add or remove an app.

Step 2: Get consent for non-essential cookies

Turn on the cookie banner under Settings > Customer privacy > Cookie banner, set it for the UK and EEA, and make sure every tracking pixel waits for a yes. Shopify says data from visitors who decline isn't used for non-essential purposes, including advertising, when consent runs through its banner or a properly integrated app. Scripts hard-coded into your theme aren't covered. My guide to setting up cookie consent on Shopify has the full steps and the tests to run.

Step 3: Collect marketing consent properly

For UK and EU customers, I treat email marketing as opt-in: only people who've actively agreed get marketing, and every email lets them unsubscribe. In Shopify, consent is collected in three places:

1. Checkout checkbox. Go to Settings > Checkout and find the Marketing opt-in section. Select Email, then choose Regions recommended by Shopify or Regions you choose to control where the box is preselected. For UK and EU customers, I leave it unticked so customers opt in themselves.
2. SMS. In the same section, set up SMS consent with the Checkout only option if you send texts. Treat it as a separate consent from email.
3. Double opt-in. Go to Settings > Notifications > Customer notifications, find Marketing double opt-in and select Customer marketing confirmation. New subscribers then confirm by email before you market to them. Shopify notes that this can help with GDPR compliance, and it gives you proof of consent.

Sign-up forms from apps, pop-ups and footer forms need the same care: no pre-ticked boxes, clear wording about what people will receive, and the consent synced to Shopify so a customer who unsubscribes in one place is unsubscribed everywhere. If you're choosing an email platform, my Klaviyo vs Mailchimp comparison looks at two popular email platforms for Shopify. Whichever you pick, check that unsubscribes sync both ways.

Step 4: Handle access and erasure requests

People can ask what data you hold about them, ask you to correct it, ask you to delete it, object to direct marketing, and ask for a copy in a machine-readable format. The European Commission says you must reply without undue delay and in principle within one month, free of charge unless a request is manifestly unfounded or excessive. You may ask for extra information to confirm the person's identity, and you should before you send anything.

To export a customer's data:

1. Verify who's asking. Reply from your store's email address and confirm details only the customer would know, such as an order number and delivery postcode.
2. Open the profile. In your Shopify admin, click Customers and open the customer's profile.
3. Request the data. Click More actions > Request customer data.
4. Collect it. Refresh the profile page to view the data. The store owner also receives it by email.
5. Add what Shopify doesn't hold. Check your email platform, reviews app, help desk and any spreadsheets, and include that data in your reply.

To erase a customer's data:

1. Check for open orders. If the customer has active pre-orders or subscriptions, remaining payments won't be charged and subscriptions are canceled once their data is erased. Settle these first.
2. Submit the request. Open the profile, then click More actions > Erase personal data. Shopify processes it, so you don't need to contact Support.
3. Know what stays. Personal data such as name and address is erased, but sales details, the profile and the order history remain in your admin.
4. Check your apps. Shopify sends the erasure request to every installed app that might hold the customer's data. Confirm with each app's developer that it was acted on, and contact any other company you shared the data with yourself.
5. Keep a record. Note the date of the request, your checks and your reply. You can cancel a pending erasure within 10 days from the Erasure request submitted section of the profile.

Step 5: Audit your apps

Every app with access to customer data is another processor in your chain. On most stores I review, there are more apps with customer data than the owner remembers installing. Once a year, and whenever you add one:

• List them. Check your installed apps in the admin, and use the free Shopify app detector to see which load on your storefront.
• Check what each one accesses. Customer names, emails, addresses and order history are the sensitive ones.
• Read the data terms. Look for a data processing agreement and where the app stores data.
• Remove what you don't use. An unused app with customer access is risk with no benefit. Uninstall it and ask the developer to delete your store's data.
• Update your privacy policy to match what's left.

Step 6: Pay the ICO fee and plan for a breach

In the UK, businesses and sole traders that process personal data must pay a data protection fee to the Information Commissioner's Office unless they're exempt. GOV.UK lists £52 or £78 for most small and medium-sized businesses, and up to £3,763 for large ones. The ICO's self-assessment tells you which applies and whether you're exempt.

If a breach happens, such as a staff account being compromised or a customer export emailed to the wrong person, the European Commission's guidance says you must notify the supervisory authority without undue delay and at the latest within 72 hours of becoming aware of it, if it's likely to put people at risk. If the risk to people is high, you must tell them too. Prepare now:

• Turn on two-step authentication for every staff account, and remove staff who've left.
• Give staff only the permissions they need, especially for customer data and exports.
• Keep a one-page breach plan: who decides, who contacts the regulator, and how you'll tell customers.

Common mistakes

• Using the policy template untouched. Without legal bases and your real apps, it doesn't describe your store.
• Preselecting the marketing checkbox for UK and EU customers. Consent should be an active choice.
• Importing a bought or old list as subscribers. If you can't show when and how each person agreed, don't email them.
• Erasing in Shopify and forgetting the email platform. If your email tool still holds the address, the request isn't done.
• Missing the one-month deadline. Requests land in shared inboxes and get lost. Log them the day they arrive.
• Too many staff with full access. Every extra account is another way in.
• Not paying the ICO fee. The ICO can fine you for not paying it.

GDPR checklist for Shopify stores

• Privacy policy published, with legal bases, contact details and your real apps.
• Cookie banner on for the UK and EEA, with pixels waiting for consent.
• Marketing checkbox unticked by default for UK and EU customers.
• Double opt-in turned on.
• Pop-up and footer forms sync consent to Shopify.
• A process for access and erasure requests, with identity checks and a log.
• Apps reviewed and unused ones removed.
• ICO data protection fee paid, if you're a UK business that needs to.
• Two-step authentication on every staff account.
• A one-page breach plan.

Next steps

Start with the two jobs that touch every visitor: the privacy policy and cookie consent. Then set your marketing defaults and write down how you'll handle requests. Most stores can do all of it in an afternoon.

If your store uses custom forms, a headless setup or apps that move customer data to other systems, the consent and deletion flow needs a closer look. My Shopify developer page for UK stores explains how I work, and I can check your privacy setup as part of a free store review. Store development starts from $300, with a fixed quote.

Frequently asked questions

Sources

1. Complying with GDPR, Shopify Help Center
2. Processing customer data requests, Shopify Help Center
3. Collecting customer contact information, Shopify Help Center
4. Data protection fee, GOV.UK
5. Dealing with requests from individuals, European Commission
6. What is a data breach and what do we have to do, European Commission

Related services and work

Written by Ashraf Siddik

I'm a Shopify developer and CRO specialist. I have built and improved Shopify stores since 2018, completed more than 1,000 projects, and hold a 4.96 average rating across 719 client reviews.

About me · Client reviews