Processing customer data requests

As a Shopify Merchant, when you sell products through Shopify, you are responsible for complying with the privacy and data protection laws and regulations that apply to your business. Privacy and data protection are critical foundations for ecommerce, and are important to your customers

If you're a store owner or a staff member with the required customer permissions, then you can complete a customer's request to access or delete their personal data from your Shopify admin. See below for details on how to action these customer requests.

Caution

The following content provides general information to merchants about privacy and data protection laws and regulations and is for informational purposes only. You're responsible for reviewing and using this information appropriately. This content doesn't contain, and isn't meant to provide, legal advice.

You should consult your own legal counsel to determine how the laws in your region and the region in which you sell might affect your business. To sell products using the Shopify platform, you must comply with the laws of the jurisdiction of your business and your customers, the Shopify Terms of Service, the Shopify Data Processing Addendum, and any other applicable Shopify policies, including the Shopify Acceptable Use Policy.

Obtain and export a customer's data

Customers may have a right in certain circumstances to access their personal information depending on where they reside. If as a merchant you receive an access or data portability request from a customer, then you can request a copy of the customer's data from visits to your store that is processed by Shopify via the following steps, which can help you in responding to valid customer access requests. You may need to verify the customer's identity before you can process the requests, as permitted or required under applicable law.

Steps:

1. From your Shopify admin, click Customers.
2. From the customer list, click the customer profile that you want to request a log for.
3. Click More actions > Request customer data.
4. Refresh the customer's profile page to access the customer's data. If you're the store owner, then this data is also sent to your email.
5. Provide the customer with the data that they requested if you have determined this is legally required or consistent with your store's policies.

Erasing a customer's personal data

As a Shopify merchant, you can request to erase a customer's personal data from your store and from any apps and channels that you've installed from your Shopify admin. In response to a request to erase, Shopify erases personal data, such as your customer's name and address. Certain information, like what was sold and the date and time of the sale, is still visible in your admin. It's your responsibility to contact any other companies that you've shared the customer's personal data with.

Caution

When erasing a customer's personal data for a customer with active pre-authorized payments, such as pre-orders or subscriptions, the remaining payments aren't charged. Subscription contracts are canceled, and any pre-authorized payments for orders don't materialize. You incur a loss on those partial sales if the customer doesn't pay the remaining amount before submitting a request to erase their personal data.

Note

A request to erase a customer's personal data doesn't erase data Shopify receives as a result of the customer's relationship with Shopify through services like Shop and Shop Pay. Customers, including Shop and Shop Pay users can submit requests to erase their personal data through the Shop app account settings or the Shopify privacy portal.

Steps:

1. From your Shopify admin, click Customers.
2. From the customer list, click the customer profile that you want to request an erasure for.
3. Click More actions > Erase personal data.

Processing erasure requests

By default, if a request for erasure is submitted and the customer has made an order in the last 180 days, then the request for erasure will remain in a pending state for 180 days since the customer's last order, in case a chargeback occurs. You will see a notification with the date when the customer's personal data will be erased. On that date, Shopify completes the erasure request. You don't need to submit another request.

If you want to override this process and complete the erasure request, then contact Shopify Support.

Cancel a pending erasure request

After you submit a request to erase your customer's personal information from your store, you have 10 days to cancel the request. If an erasure request is submitted through the Shopify admin, then only users in your store can cancel it. If a partner app submits the request, then only that partner can cancel it.

Steps:

1. From your Shopify admin, click Customers.
2. From the customer list, click the customer profile that you requested an erasure for.
3. In the Erasure request submitted section, click Cancel request.

Editing or deleting a customer profile

As a Shopify merchant, if a customer profile already exists in Shopify, then you can edit the profile from the Customers page. Learn more about editing customer profiles.

You can also delete individual customer profiles. Some customer profiles can't be deleted, such as when the customer is associated with one or more orders, or has submitted an erasure request. When you delete an individual customer profile, this action can't be undone.

Note

Deleting a customer profile is different from erasing a customer's personal data. Learn more about deleting customer profiles.