Shopify GDPR Compliance for Non-EU Merchants

Shopify is one of the most popular e-commerce platforms globally, powering millions of stores. If you are a Shopify merchant based outside the EU but selling to EU customers, you must comply with the General Data Protection Regulation (GDPR). This includes the critical requirement under Article 27 to appoint an EU Representative.

Does Shopify Handle GDPR for You?

No. Shopify is a data processor, not a data controller. As the merchant, you are the data controller responsible for your store’s GDPR compliance. Shopify provides tools (GDPR customer data requests, cookie consent banners via apps) but the legal obligations — including Article 27’s EU Representative requirement — rest with you.

Key GDPR Requirements for Shopify Stores

1. EU Representative (Article 27)

If you are a non-EU Shopify merchant with EU customers, you must appoint an EU Representative. This is a legal person or entity established in the EU designated to represent you on GDPR matters. EU Shield provides this service from EUR 490 per year.

2. Cookie Consent

Shopify stores typically use cookies for analytics, tracking, and marketing. Under the ePrivacy Directive and GDPR, you need a cookie consent mechanism before placing non-essential cookies. Solutions include Shopify’s built-in cookie banner, consent management platforms, or dedicated GDPR apps.

3. Privacy Policy Update

Your Shopify Privacy Policy must include the EU Representative contact details, the legal basis for processing, data retention periods, and data subject rights. EU Shield provides template language for the EU Representative section.

4. Data Subject Requests

GDPR gives EU customers the right to access, rectify, erase, and port their data. Shopify provides API tools to handle data subject requests, but you must respond within 30 days.

5. Records of Processing (Article 30)

As a data controller, you must maintain a Record of Processing Activities (ROPA) documenting what customer data you collect, why, and who you share it with.

Shopify App Considerations

If you develop Shopify apps that process EU merchant or customer data, you have additional obligations as a data processor. You may need a DPA with the merchant and your own EU Representative.

Step-by-Step Shopify GDPR Compliance

1. Appoint EU Shield as your EU Representative — setup in 15 minutes
2. Review your cookie usage — install a consent management platform if needed
3. Update your Privacy Policy — include EU Representative contact and processing details
4. Document processing activities — create your ROPA
5. Set up data subject request handling — ensure you can respond within 30 days

Learn more about EU Representative for E-commerce →