Shopify GDPR Compliance: What Merchants Must Export and Delete

If you sell to consumers in the European Union (under GDPR) or California (under CCPA/CPRA), data privacy compliance is a mandatory legal obligation. However, many merchants struggle to understand how statutory "Right to Erasure" requirements interact with automated cloud data backups.

Legal Disclaimer: This guide provides technical and operational information regarding Shopify's privacy architecture and does not constitute formal legal advice. Merchants should consult qualified legal counsel for jurisdiction-specific compliance requirements.

How Does Shopify Handle GDPR Privacy Requests?

Shopify handles GDPR privacy requests through three mandatory automated webhooks that every installed app must support: customers/data_request, customers/redact, and shop/redact. When a customer requests data access or deletion from your storefront, Shopify transmits these webhooks to all connected applications.

The 3 Mandatory Shopify Privacy Webhooks

1. customers/data_request: Triggered when a customer asks for a copy of all personal data held by your store. Apps must compile and deliver relevant data payloads.
2. customers/redact: Triggered when a customer requests permanent erasure ("Right to be Forgotten"). Connected apps must delete or anonymize that individual's personal identifiers within 30 days.
3. shop/redact: Triggered 48 hours after a store uninstalls an app, directing the app vendor to permanently delete all stored store database records within 30 days.

Do Backups Violate the GDPR "Right to be Forgotten"?

No, maintaining encrypted disaster recovery backups does not violate GDPR Article 17 provided that the archives are maintained strictly for data security, access is tightly restricted, and deletion requests are reapplied if a backup snapshot is ever restored to live production.

Under European Data Protection Board (EDPB) guidance and GDPR Recital 49, maintaining backup archives for business continuity and disaster recovery constitutes a legitimate interest, provided that:

• Data is encrypted both in transit (TLS 1.3) and at rest (AES-256).


• Backup files are not searchable or utilized for marketing or operational profiling.


• If a disaster recovery restore occurs, customer redaction logs are automatically re-executed against the restored production database to re-purge erased data.

How Woonic Handles Privacy and Data Security

Woonic is engineered with privacy-by-design principles:

• Automated Webhook Ingestion: Woonic listens to all official Shopify privacy webhooks and immediately redacts customer records.


• Granular Store Cloning: When duplicating a store for staging or international branches, Woonic provides an option to completely exclude customer personal information (PII). Learn more in our Store Duplication Guide.


• Automated Uninstall Purging: When Woonic is uninstalled, all backup archives are automatically scheduled for permanent deletion within 30 business days.