GDPR

What is GDPR?

GDPR (General Data Protection Regulation) is the EU’s data protection regulation that, since 2018, governs how personal data may be collected, processed, stored, and shared. It is not limited to EU companies: a store based outside the EU is also covered if it offers goods or services to — or monitors the behaviour of — people in the EU. Among other things, it grants data subjects the right to access, rectification, erasure (the right to be forgotten), and data portability.

Why does GDPR matter?

For an online store, GDPR touches nearly everything you do with customer data: account details, orders, email lists, tracking, and advertising. Breaches can trigger fines of up to EUR 20 million or 4% of global annual turnover — whichever is higher. Trust matters just as much: customers buy more confidently when it is clear what data you keep and why. If you use external processors such as apps or fulfilment providers, GDPR requires a data processing agreement with each of them.

Common use cases

• Cookie consent. Non-essential marketing and analytics cookies require active opt-in consent before they are set (the requirement stems from the ePrivacy Directive, while GDPR defines what valid consent is).
• Data processing agreements. Sign one with every app and vendor that processes customer data on your behalf.
• Access and deletion requests. Have a process to hand over or delete a customer’s data within the deadline.
• Cross-border transfers. Check whether tools send data outside the EU/EEA.

Shopify perspective

Shopify offers the Customer Privacy API and a built-in consent banner, so you can manage cookie consent without extra code. All public Shopify apps must also handle the mandatory privacy webhooks customers/data_request, customers/redact, and shop/redact. Review your installed apps and third-party scripts — they are often what sets tracking cookies before consent is given. If you need more control, a dedicated app can help; see the best Shopify cookie and GDPR apps.