Back to Checklists
14 min read•Checklist

Shopify GDPR Compliance Checklist

GDPR compliance is not optional if you sell to EU or UK customers. Use this 67-point checklist to protect your customers and your business.

67 items8 sections

Why GDPR Matters

GDPR applies if you process data from EU or UK customers, regardless of where your business operates. Non-compliance carries fines up to 20 million euros or 4% of annual turnover. Important: This checklist provides general guidance, not legal advice. Consult privacy lawyers for advice specific to your circumstances.

0 of 67 completed
0%

Privacy Policy

0 of 10 completed

Cookie Consent

0 of 9 completed

Data Collection & Consent

0 of 8 completed

Customer Rights

0 of 8 completed

Third-Party Apps & Services

0 of 8 completed

Email Marketing Compliance

0 of 8 completed

Data Security

0 of 8 completed

Documentation & Training

0 of 8 completed

Beyond Compliance: GDPR as Competitive Advantage

While many stores view GDPR as burdensome regulation, forward-thinking retailers recognise it as an opportunity. Research shows 86% of consumers report privacy concerns, and 78% consider a company's privacy practices when making purchase decisions.

GDPR Core Principles

Lawfulness

You need legal basis for processing data

Transparency

Customers must understand what you do with their data

Purpose Limitation

Use data only for stated purposes

Data Minimisation

Collect only what is necessary

The Business Case for Compliance

  • ✓Higher quality email lists from explicit consent requirements
  • ✓Reduced tracking bloat from auditing which tools actually add value
  • ✓Increased trust that improves conversion rates
  • ✓Future-proofing against expanding global privacy regulations

Key Penalties

20M euros
Maximum fine
4%
Of annual global turnover

Essential First Steps

Start with these fundamental compliance requirements:

1. Install a cookie consent banner

Block non-essential cookies until visitors consent. Many Shopify apps provide compliant solutions.

2. Update your privacy policy

Clearly explain what data you collect, why, and who you share it with. Link it from every page.

3. Fix your email consent

Remove pre-ticked marketing checkboxes at checkout and newsletter signups. Consent must be explicit.

4. Audit your apps

List all apps that access customer data. Check their GDPR compliance and add them to your privacy policy.

Related Checklists

Combine GDPR compliance with broader best practices:

Launch Checklist →

Include compliance from day one

Security Checklist →

Protect the data you collect

Email Marketing →

Compliant email practices

Analytics Checklist →

Privacy-compliant tracking setup

Frequently Asked Questions

GDPR applies if you sell to customers in the EU or UK, regardless of where your business is located. If you ship to Europe, accept European payment methods, or advertise to European audiences, you must comply. Non-compliance can result in fines up to 20 million euros or 4% of annual global turnover, whichever is higher. Even small stores face enforcement risk, so compliance is essential.
Essential cookies are strictly necessary for your store to function (shopping cart, checkout, security, load balancing). These do not require consent. Non-essential cookies include analytics (Google Analytics), marketing (Facebook Pixel), personalisation, and third-party embeds. These require explicit consent before loading. Cookie consent banners must give users genuine choice to reject non-essential cookies.
Yes, if you sell to EU or UK customers. GDPR applies based on where your customers are located, not where your business operates. A US-based store selling to UK customers must implement cookie consent for those visitors. Use geolocation to show consent banners only to EU/UK traffic if preferred, though many stores find universal consent banners simpler to maintain.
No. GDPR requires active, explicit consent. Pre-ticked boxes do not constitute valid consent. Users must take deliberate action (ticking an empty box, clicking a button) to opt in to marketing. This applies at checkout, account creation, and newsletter signups. Document when and how consent was obtained for compliance audits. This requirement reduces list size but dramatically improves list quality and engagement.
You must delete their personal data within 30 days unless you have legitimate legal grounds to retain it (e.g., tax requirements, fraud prevention, defending legal claims). Shopify lets you redact customer data whilst preserving necessary business records. Inform the customer when deletion is complete. Also notify any third parties who received the data. Keep documentation of the request and your response.
Not automatically. Each app's compliance depends on its developer. Before installing apps that access customer data, review their privacy policy, check for GDPR compliance statements, ensure they have data processing agreements (DPAs), and understand where they store data. Many reputable apps are compliant, but it is your responsibility to verify. List all data-processing apps in your privacy policy.

Need Compliance Help?

We can help implement cookie consent, privacy policies, and GDPR-compliant processes on your Shopify store.

Get HelpTalk to Us