Shopify GDPR Compliance: What Shopify Covers and What You Still Have to Do

Shopify GDPR compliance is shared work. Shopify runs the platform as your data processor under its Data Processing Addendum, protects transfers out of Europe with Binding Corporate Rules and Standard Contractual Clauses, and gives you privacy tools in Settings > Customer privacy plus data request and erasure buttons on every customer profile. But under the GDPR you, the merchant, are the controller of your customers' data. Choosing a lawful basis, publishing an accurate privacy policy, getting consent for non-essential cookies and marketing, answering data requests, vetting apps and keeping records stay your job. So the short answer to "is Shopify GDPR compliant?" is that Shopify can support a compliant store, but it can't make your store compliant for you.

This guide is general information based on the GDPR text, regulator guidance and Shopify's documentation as of October 2026. It isn't legal advice. For decisions about your own business, ask a qualified privacy professional.

Is Shopify GDPR compliant?

Shopify's own GDPR guide for merchants says it provides tools that can help with GDPR compliance, but that you remain responsible for understanding your obligations and configuring the platform. The contract terms explain why.

Shopify is usually your processor. The Shopify Data Processing Addendum (DPA), last updated on 7 July 2026, says that for your customers' personal data you act as the data controller and Shopify acts as the data processor. The DPA is incorporated by reference into Shopify's Terms of Service, so it applies as part of those terms rather than as a separate contract.

Shopify is sometimes a controller. Appendix E of the DPA makes Shopify a controller when you receive Enhanced Services, where Shopify uses customer data for analytics, product customization and advertising. You can switch this off by disabling Shopify Network Intelligence. Data that Shopify receives through Shop and Shop Pay is also outside your erasure tools: Shopify's guide to processing customer data requests says customers ask for that through the Shop app or Shopify's privacy portal at privacy.shopify.com.

You make promises in the DPA. In Section IV.C you represent that you comply with data protection law, that you have the rights and consents needed to share customer data with Shopify, and that your customers can exercise their data rights.

Does the GDPR apply to your Shopify store?

If you sell to people in the EU or EEA, it very likely does, even if your business is based elsewhere. Article 3(2) of the GDPR covers businesses outside the EU that offer goods or services to people in the EU or monitor their behavior there. The EDPB's guidelines on territorial scope explain how to judge whether you target EU customers, with signs such as delivering to EU countries or using an EU language or currency that isn't your home market's.

The UK has its own version, the UK GDPR, enforced by the ICO. Most of this guide applies there too. One recent difference: under the Data (Use and Access) Act 2025, the ICO says every organisation that handles personal data must now give people a way to make a data protection complaint, acknowledge it within 30 days, investigate it and tell the person the outcome.

Two roles are worth checking early:

• EU representative. Article 27 asks a business outside the EU that falls under Article 3(2) to designate a representative in the EU in writing. The exemption covers processing that is occasional, low risk and doesn't include large-scale sensitive data. Whether a store that ships to EU customers every week fits that exemption is a question for a professional. Shopify's GDPR guide notes your privacy policy may need the representative's contact details.
• Data protection officer. The EDPB's guide for small businesses says a DPO is mandatory when your core activities involve regular and systematic monitoring of people on a large scale, or large-scale processing of sensitive data. Most small stores don't meet that test, but a business built on behavioral profiling might.

What does Shopify do for GDPR compliance?

What do Shopify's contract terms cover?

The DPA sets out how Shopify handles your customers' data, including breach notices, audits and what happens to data when your agreement ends. Shopify lists the companies that process data for it on its subprocessors page, split into Shopify entities and third-party providers. Click Sign up for notifications there to hear about new subprocessors. Under the DPA you can object to a new subprocessor and, if Shopify can't accommodate the objection, end the affected services within 30 days of the notice.

Does Shopify keep customer data in Europe?

Not necessarily. The GDPR doesn't require personal data to stay in Europe, but data sent elsewhere must stay protected. Merchants in Europe, the Middle East and Africa contract with Shopify International Limited, an Irish company. The DPA says customer data may be processed in any country where Shopify, its affiliates or its providers are located, including Singapore and Canada, and names these safeguards:

• Binding Corporate Rules for transfers from the EEA and Switzerland to Shopify entities elsewhere. Shopify's Binding Corporate Rules page says they were approved by European data protection authorities and that the current versions took effect on 8 July 2026.
• Standard Contractual Clauses from 2021, with the UK addendum and a Swiss version. Transfers from the UK to other Shopify entities rely on these clauses rather than the Binding Corporate Rules, and Shopify's onward transfers page says they also cover transfers to subprocessors.
• The EU adequacy decision for Canada, home of Shopify's parent company.

The DPA doesn't mention the EU–US Data Privacy Framework. Note that Shopify's Help Center page on onward transfers still calls the Binding Corporate Rules an application in its final stages; the DPA and the rules page are more current.

Which privacy settings does Shopify give you?

Go to Settings > Customer privacy. According to Shopify's privacy settings guide, this is where you:

• Set up the Privacy policy, either with Use automated policy or your own text.
• Configure the Cookie banner. For new stores it's set up automatically for UK and EEA visitors if you have active markets there, and off elsewhere by default.
• Set up the Data sharing opt-out page, meant for regions that don't require opt-in consent, such as the US.
• Turn Shopify Network Intelligence on or off.

Shopify's GDPR guide adds that the same area lists installed privacy apps and lets you manage some marketing settings. New stores have automated privacy settings on by default. Behind the banner, Shopify's Customer Privacy API records each visitor's consent for analytics, marketing and preferences, plus any opt-out of the sale or sharing of data, and the pixels overview says pixels in Settings > Customer events run in consent regions only once the visitor has given the permissions they need.

Each customer profile also has More actions > Request customer data and More actions > Erase personal data, covered under data requests below.

How is store data kept secure?

Shopify's GDPR guide says it uses measures such as encryption, firewalls and regular security audits. Your part is the admin itself: Shopify's account security guide recommends two-step authentication for you and your staff, adding staff as their own accounts instead of sharing your login, and making sure staff can reach only the areas they need.

What do merchants still have to do?

1. Choose a lawful basis for each purpose

Article 6(1) of the GDPR gives six lawful bases. The EDPB's small business guide explains them with examples, including a retailer processing card details to complete a purchase under contract. The table shows bases commonly used for typical store purposes; your own assessment may differ.

For Enhanced Services, Shopify's GDPR guide gives a sample disclosure to adapt with legal counsel: consent for personalized ads, legitimate interests for purposes such as product improvement.

2. Publish a privacy policy that matches your store

Article 13 lists what you must tell people when you collect their data: who you are, each purpose and its legal basis, recipients, transfers, retention and their rights. Shopify's automated policy is a starting point, but its GDPR guide says stores or customers in the UK, EEA or Switzerland may need to add the legal basis for each purpose and DPO or representative contact details.

If you keep Shopify Network Intelligence on and use Enhanced Services, Shopify asks you to link to its Consumer Privacy Policy, say that Shopify hosts your store and processes customer data, disclose that activity is shared with Shopify and third parties, and link to the opt-out at privacy.shopify.com. Our guide to the Shopify privacy policy walks through a data-flow checklist, and ShopOpsy's Privacy Policy Setup is a one-time $79 drafting service if you'd rather have it written from your apps and tools.

3. Get consent before non-essential cookies and pixels

Cookie consent comes from the ePrivacy rules that sit alongside the GDPR. The EDPB's cookie banner taskforce report recalls that cookies requiring consent can't be set without a positive action from the visitor, and a vast majority of authorities in the taskforce saw an accept button with no reject option on the same layer as an infringement. Under Article 7(3), withdrawing consent must be as easy as giving it.

Shopify's built-in banner passes each choice to the Customer Privacy API, which Shopify says applies consent to Shopify-managed surfaces such as pixels and checkout. A script pasted into theme code, or an app that doesn't check the API, sits outside that system and can still run before consent, so test it. Our guides cover each piece:

• Shopify cookie banner: setup, limits and how to test that trackers wait.
• Shopify Customer Privacy API: how consent reaches Shopify, pixels and apps.
• Shopify customer events: moving tracking into custom pixels that respect consent.
• Google Consent Mode v2 on Shopify: passing the choice to Google tags. Shopify's privacy settings overview says EEA event data isn't used for personalized ads unless it's active and valid consent is obtained.
• Shopify cookie policy: listing your cookies by category.

ShopOpsy's Cookify, coming soon to the Shopify App Store, holds supported trackers such as Google tags, Meta Pixel, TikTok Pixel and Klaviyo until the visitor allows that category and passes every choice to the Customer Privacy API. Its Advanced plan adds Google Consent Mode v2, country targeting and consent logs. It doesn't hold script tags written directly into theme code, so load those through Google Tag Manager or Customer events instead.

4. Collect marketing consent the right way

Shopify's checkout opt-in lives in Settings > Checkout, in the Marketing opt-in section, according to its guide to collecting customer contact information:

1. Select Email to show the email marketing checkbox. For SMS or WhatsApp, choose Checkout only from the drop-down in the SMS or WhatsApp section.
2. Decide whether the email checkbox is preselected. Regions recommended by Shopify follows local law in the customer's country. Regions you choose is the default and starts with no regions selected; with none selected, the box is never preselected.
3. For a confirmation email, go to Settings > Notifications > Customer notifications and, in the Marketing double opt-in section, select Customer marketing confirmation. It needs the Online Store sales channel. If your store is located in Germany, Shopify adds a Require customers to confirm their subscription checkbox to the Email marketing section of the Notifications settings page.

Under the GDPR, a pre-ticked box doesn't give valid consent, as the EDPB's consent guidelines explain, so check that nothing is preselected for EU and UK customers. In the UK, the ICO's email marketing rules allow a "soft opt-in" for existing customers only when you got their details during a sale or negotiations for one, market similar products and offered a simple opt-out both at collection and in every message. Article 21 also gives everyone the right to object to direct marketing at any time, so make unsubscribing easy in every email and text.

5. Answer data subject requests on time

People have rights to access, correct, erase, restrict, move and object to the use of their data. The EDPB's guidance on individual rights says to reply within one month, extendable by two further months for complex requests if you tell the person within the first month. Requests are free unless manifestly unfounded or excessive, and you may ask for more information when you have reasonable doubts about who is asking.

To handle a request in Shopify:

1. In your admin, click Customers and open the customer's profile.
2. For an access request, click More actions > Request customer data. Refresh the profile to view the data; the store owner also gets it by email.
3. For an erasure request, click More actions > Erase personal data. You have 10 days to cancel it from the Erasure request submitted section of the profile.
4. Contact every other company you shared the data with, such as your email platform. Shopify's guide says this is your responsibility.
5. Reply to the customer and note what you did and when.

Know the limits before you promise anything:

• Erasure keeps the sale. Shopify removes details such as name and address but keeps what was sold and when. Deleting a customer profile is a different action that removes the whole profile.
• Erasure stops future payments. Remaining payments on preorders and subscriptions aren't charged, subscription contracts are canceled, and Shopify warns you may take a loss on partly paid orders.
• Apps can take longer. Apps with customer or order access receive a customers/redact request. Shopify's developer docs say it's sent 10 days after your request if the customer hasn't ordered in the past six months, otherwise it waits until six months have passed, and apps must act within 30 days of receiving it.
• Some data can stay. Article 17(3)(b) lets you keep data you must hold to meet a legal obligation, such as tax records.

6. Vet every app as a processor

Article 28 says a controller may use only processors that give sufficient guarantees, under a contract that sets out the processing. An app that handles customer data on your behalf is usually one of those processors. Shopify's guide to finding and choosing apps, in its section on personal information apps can access, says apps can access customer contact details, and some can ask for your last 60 days of orders or all orders. Before installing, check:

• What the app asks to access, and whether it needs it.
• Its privacy policy, linked from the App Store listing, and whether the developer offers a DPA.
• Where it stores data and which subprocessors it uses.
• Whether it loads trackers, and if so, whether it respects the Customer Privacy API.

Forty-eight hours after you uninstall an app, Shopify sends the developer a request to erase the personal data it collected. Shopify says to contact the developer if you want to confirm the deletion. Remove apps you no longer use.

7. Keep records and a breach plan

Article 30 asks controllers to keep records of processing. The EDPB small business guide lists what each entry covers: purpose, categories of data, recipients, transfers outside the EEA and, where possible, retention periods and security measures. The current exemption in Article 30(5) for organisations with fewer than 250 staff is narrow: it doesn't apply when processing isn't occasional, and an online store processes orders every day. A 2025 Commission proposal would widen it to fewer than 750 staff, except for high-risk processing (EDPB and EDPS opinion), so check whether it has been adopted before relying on it. Either way, a simple spreadsheet of your apps, data and retention periods makes requests and policy updates easier.

For breaches, the EDPB's breach guidance says to notify your data protection authority within 72 hours of becoming aware, unless the breach is unlikely to pose a risk, to tell affected people without undue delay when the risk is high, and to record every breach, reported or not. For customer data covered by European law, Shopify's DPA commits it to notify you without undue delay after becoming aware of a breach, so make sure the store owner email is monitored.

Shopify GDPR compliance checklist

If you're asking how to make your Shopify store GDPR compliant, start here. Work through this list once, then repeat it whenever you add an app, a pixel or a new market.

1. Scope: list the countries you sell to and decide whether you need an EU or UK representative or a DPO.
2. DPA: read Shopify's DPA and save a copy with your records.
3. Network Intelligence: in Settings > Customer privacy, decide whether to keep it on, and update your privacy policy if you do.
4. Apps: go through Settings > Apps and note what each app accesses, where its privacy policy is and whether it offers a DPA. Uninstall what you don't use.
5. Tracking: list every pixel in Settings > Customer events and every script in your theme. Move theme scripts into custom pixels or a consent tool.
6. Cookie banner: set it up in Settings > Customer privacy > Cookie banner or with a consent app, with regions that match your markets and a reject option on the first layer.
7. Test consent: in a private window from a consent region, confirm that analytics and marketing requests don't fire before you accept.
8. Privacy policy: add your apps, pixels, legal bases, transfers, retention periods and contact details, then publish.
9. Cookie policy: publish one if your privacy policy doesn't list cookies by category.
10. Marketing consent: in Settings > Checkout, check that the email box isn't preselected for EU and UK customers, and decide on double opt-in.
11. Requests: write a short procedure for access and erasure requests, with identity checks and a one-month deadline.
12. Records: keep a list of processing activities and retention periods.
13. Security: turn on two-step authentication and review staff permissions.
14. Breaches: write down who decides whether to notify the regulator, and how you'd meet 72 hours.
15. UK GDPR: if it applies to you, give customers a way to complain about data protection and acknowledge complaints within 30 days.

Common Shopify GDPR problems and how to fix them

Frequently asked questions

What happens if my Shopify store isn't GDPR compliant?

Data protection authorities can act on complaints and issue fines. Under Article 83 of the GDPR, fines depend on the circumstances of each case. The maximum for breaking core rules, such as the lawful basis, consent conditions and people's data rights, is €20 million or 4% of total worldwide annual turnover, whichever is higher. Many other duties, including processor contracts, records and breach notices, have a lower cap of €10 million or 2%.

Can I turn off Shopify Network Intelligence?

Yes. In Settings > Customer privacy, find the Shopify Network Intelligence section, click Disable, type UNINSTALL and click Uninstall. Only the store owner or staff with the Administrator role can do this. Shopify's privacy settings guide says some apps and features, such as the Shop channel and Shopify Audiences, are uninstalled right away and aren't restored if you turn it back on.

What happens to customer data if I close my store?

It isn't deleted straight away. Shopify's deactivation guide says it keeps a deactivated store's information for 2 years in case you reopen, and that you can ask for your customers' personal information to be deleted before then. Once your agreement ends, Shopify's DPA says it deletes or returns your customer personal data at your choice, though it may keep some where the law requires or under its standard backup policies. Export what you need to keep first; our guide on how to close a Shopify store lists the exports and how to request deletion.

Sources

• Using Shopify to help comply with GDPR — Shopify Help Center, accessed 26 October 2026.
• Processing customer data requests — Shopify Help Center, accessed 26 October 2026.
• Configuring customer privacy settings — Shopify Help Center, accessed 26 October 2026.
• Understanding customer privacy settings in your Shopify admin — Shopify Help Center, accessed 26 October 2026.
• Shopify's primary contracting entities and transfers from the merchant to Shopify — Shopify Help Center, accessed 26 October 2026.
• Onward transfers of personal data — Shopify Help Center, accessed 26 October 2026.
• Subprocessors — Shopify Help Center, accessed 26 October 2026.
• Collecting customer contact information — Shopify Help Center, accessed 26 October 2026.
• Finding and choosing apps — Shopify Help Center, accessed 26 October 2026.
• Pixels overview — Shopify Help Center, accessed 26 October 2026.
• Account security best practices — Shopify Help Center, accessed 26 October 2026.
• Deactivating and reactivating your Shopify store — Shopify Help Center, accessed 28 October 2026.
• Shopify Data Processing Addendum — Shopify, accessed 26 October 2026.
• Shopify's Binding Corporate Rules — Shopify, accessed 26 October 2026.
• Customer Privacy API — Shopify developer documentation, accessed 26 October 2026.
• Privacy law compliance (mandatory compliance webhooks) — Shopify developer documentation, accessed 26 October 2026.
• Regulation (EU) 2016/679 (General Data Protection Regulation) — EUR-Lex, accessed 26 October 2026.
• Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) — European Data Protection Board, accessed 26 October 2026.
• Guidelines 05/2020 on consent under Regulation 2016/679 — European Data Protection Board, accessed 26 October 2026.
• Report of the work undertaken by the Cookie Banner Taskforce — European Data Protection Board, accessed 26 October 2026.
• Process personal data lawfully — EDPB data protection guide for small business, accessed 26 October 2026.
• Respect individuals' rights — EDPB data protection guide for small business, accessed 26 October 2026.
• Be compliant — EDPB data protection guide for small business, accessed 26 October 2026.
• Data protection officer — EDPB data protection guide for small business, accessed 26 October 2026.
• Data breaches — EDPB data protection guide for small business, accessed 26 October 2026.
• Targeted modifications of the GDPR: EDPB and EDPS welcome simplification of record keeping obligations and request further clarifications — European Data Protection Board, accessed 26 October 2026.
• Electronic mail marketing — Information Commissioner's Office, accessed 26 October 2026.
• New data protection complaints law now in force — Information Commissioner's Office, accessed 26 October 2026.