Here's What You Need to Know About GDPR for Shopify

Since May 25, 2018, the General Data Protection Regulation has impacted companies of all sizes worldwide. This set of rules and regulations were put in place to control the way personal data is collected and used by businesses. It is often thought that the GDPR only affects businesses operating out of the European Union. Still, this regulation can impact any business that collects and stores information on EU users or customers. 

The millions of dollars in fines that have been dished out to mammoth corporations like Facebook and Google are top of mind when it comes to GDPR consequences, but the impact the trailblazing regulation can have on small businesses such as Shopify stores is often overlooked. This article will help prepare you Shopify savants for proper navigation through the important privacy practices governed by the GDPR!

How GDPR affects Shopify stores

As a business collects customer data, it becomes possible to put together a picture of who that customer is. Things like email addresses, home addresses, phone numbers, age, and other personally identifiable information can be used to learn valuable information about a customer. The GDPR is concerned with the collection of data by businesses. As a Shopify merchant, you are in control of personally identifiable information from customers and must adhere to the guidelines of the GDPR when acting with this data. The following outlines the burden of responsibility for a Shopify merchant under the GDPR…

Consent:

Shopify merchants must obtain consent from customers to collect, store, and use personally identifiable information. The merchant must inform the customer of what information is being collected and how it is being used before obtaining consent for this usage from the customer. Consent for signing up customers for marketing emails or other outreach methods can not be a prerequisite of service and must be obtained separately.

Verification of Third Parties:

As a Shopify merchant, you are held responsible for data security issues from third-party partners you are using. If the third-party partner fails to comply with GDPR regulations while storing or using your customer's data, you could be at risk of punishment. It is important to confirm with third parties that they comply with GDPR to prevent backlash to your Shopify store.

Security of Data:

Once you have received consent from the customer to collect, store, and use their data, it is important to take data security very seriously. Shopify merchants are held responsible for data breaches that spill customer's personal information. If a data breach occurs, the Shopify merchant must inform those who are affected within 72 hours.

Data Requests:

Under the GDPR, users are empowered to access the data collected on them and have it changed or erased at their request. If an EU resident requests to view, change or erase personal data being stored by Shopify, you must comply. When a request is made, the Shopify merchant has 72 hours to acknowledge it and 30 days to comply. The data given to the customer as per their request must be readable and easily accessible. For more information on how to make the process of complying with data requests easier, please see the “Getting your store GDPR compliant” section of this article below.

Documentation:

It is essential to document all of these steps taken towards complying with the GDPR. Documentation is very important for Shopify merchants if they ever run into trouble with the GDPR as it shows effort towards compliance. 

Having a privacy policy on your Shopify store is required to transparently outline what kind of data you collect, what you use it for, how long you store it, who you store data on, and your plan for securing data. For more information on how to easily implement a comprehensive privacy policy for your Shopify store visit the “Getting your store GDPR complaint” section of this article below. 

Getting your store GDPR compliant

Enzuzo's powerful Shopify app helps get you GDPR compliant within minutes so you can focus on growing your Shopify sales, rather than dealing with tedious privacy practices. 

The Enzuzo Data Privacy & Trust app enables Shopify merchants to easily add a privacy policy page hosted by Enzuzo to their Shopify store. This privacy policy is comprehensive and includes the ability to customize sections and the theme of the page. Translated versions of the privacy policy are also offered in 10 languages. The privacy policy also comes equipped with a data request button that enables customers to file a data request seamlessly to your Shopify store. 

Shopify merchants can streamline data requests and easily comply with GDPR regulations by using Enzuzo’s data request dashboard. This dashboard helps organize completed and outstanding data requests from customers. It tracks time left before compliance for a data request is required by the GDPR and offers one-click deletion of customer data. Enzuzo enables Shopify merchants to generate compliance reports of completed data requests to confirm your brand is compliant with the GDPR.

Ready to become a data privacy champion? Download the Enzuzo Data Privacy & Trust Shopify app here or visit enzuzo.com for more information on how we can help your Shopify store become GDPR compliant in less than 10 minutes!