GDPR Compliance for Shopify App Developers

Developing Shopify apps that access merchant or customer data creates a distinct set of GDPR obligations. For non-EU developers of Shopify apps, you are likely a data processor (or controller) under GDPR, and Article 27 requires an EU Representative.

Are You a Controller or Processor?

Data processor: If your app processes Shopify merchant data based on the merchant’s instructions — typical for most apps. You need a DPA with each merchant. The merchant is the controller; you are the processor.

Independent controller: If your app collects data for your own purposes (analytics, product improvement, training ML models), you are a controller for that processing. Full GDPR controller obligations apply.

Shopify API Data Access

Shopify’s GraphQL API provides access to: customer data (names, emails, addresses, order history), order data (transaction amounts, payment status, fulfillment status), product data (creator/admin contact info), and store configuration data. All of this may include EU personal data. Your app must only request the minimum necessary scopes (OAuth), and you must document in your ROPA exactly what data your app accesses. SaaS checklist →

Data Retention and Deletion

When a merchant uninstalls your app, Article 17 (right to erasure) and Article 28(3)(g) require you to delete or return the merchant’s data. Implement automated data deletion on uninstall webhooks. Document this obligation in your DPA with merchants.

Shopify App Store Review Requirements

Shopify requires app listing compliance with GDPR: Privacy Policy URL in the app listing, data handling disclosures, and compliance with Shopify’s Partner Program Requirements. Having a EU Representative demonstrates GDPR compliance to both Shopify and potential merchants.

Compliance Checklist

1. Determine controller vs processor status for each data processing activity
2. Appoint EU Shield as your EU Representative
3. Create a DPA template for merchants (if processor)
4. Document API data access scopes and purposes in ROPA
5. Implement automatic data deletion on app uninstall
6. Update Privacy Policy with EU Rep contact and processing details
7. Include EU Rep reference in Shopify app listing

Get your EU Rep →