accountcraft Install free
All articles

AccountCraft Journal

Shopify DSAR Process: A Step-by-Step Guide for Merchants

How to handle a data subject access request in Shopify: find the customer, request their data, verify identity, meet deadlines, erase data and keep records.

12 min read

A data subject access request (DSAR) is a customer asking what personal data you hold about them, or asking you to correct or erase it. In Shopify, you handle it from the customer’s profile in your admin: verify who is asking, request the data, send it to them securely, and keep a record of what you did. This guide walks through each step, the deadlines that may apply, and how to cut down the manual work.

AccountCraft
Let Customers Manage Their Data
AccountCraft adds personalized Shopify account pages where customers can view and edit their information, with built-in consent management.
Install AccountCraft

TL;DR

  • In Shopify admin, go to Customers, open the profile, then choose More actions > Request customer data. Refresh the profile to see the data.
  • You are responsible for following the privacy laws that apply to your business. Verify the requester before you send anything.
  • Deadlines depend on where the customer lives: one month under GDPR, 45 days under California rules. Log the date you received each request.
  • Erasure removes personal details such as name and address, but order records stay in admin.
  • Give customers a way to view and edit their own data, and you will get fewer requests to begin with.

Table of Contents

What a Shopify DSAR is and which laws may apply

A DSAR is a formal request from a person about their own personal data. It usually takes one of three forms: access (“send me a copy”), correction (“fix this”) or erasure (“delete it”). Shopify’s Help Center says merchants are responsible for complying with the privacy and data protection laws that apply to their business, and that customers may ask for access to their data or for it to be erased (Shopify Help Center).

Which law applies depends on where the customer is, not only where you are. The most common ones for a US-based store:

  • GDPR (EU and UK): applies when you sell to people in those regions.
  • CCPA/CPRA (California): gives California residents rights to know, correct and delete.
  • Other US state laws: several states have comparable laws, and many use a similar 45-day response window, according to a summary of DSAR deadlines.

Whether a particular law covers your store is a legal question. Ask your attorney or privacy counsel. The steps below are the mechanics in Shopify, not legal advice.

How customers send a request and how you start one for them

Requests reach you in different ways: an email to your support address, a contact form, a message through chat, or a line in your privacy policy that points to a request channel. Whatever the channel, treat the day it arrives as day one. Under California’s regulations, the response period starts the day the business receives the request, regardless of how long verification takes (Cal. Code Regs. tit. 11, § 7021).

If a customer writes to you instead of using a formal channel, you can start the request on their behalf from the customer profile in Shopify admin. That is the process in the next section.

How customers send a request and how you start one for them

The Shopify DSAR process, step by step

Step 1: Log the request

Before touching the customer record, write down:

  • The date and time you received the request
  • The channel it came through
  • The email address on the request
  • The type of request (access, correction, erasure)
  • The deadline you are working to

A simple spreadsheet or a ticket in your helpdesk is enough. This log is your evidence that you responded on time.

Step 2: Verify the requester

Shopify’s guidance notes that you may need to verify a customer’s identity before processing a request, as permitted or required under applicable law (Shopify Help Center). In practice, a store can:

  • Reply only to the email address on the customer account, never to a different address supplied in the request.
  • Ask a question only the real customer could answer, such as the order number and the approximate order date, which you can check in the order record.
  • Avoid collecting more sensitive documents than you need to confirm identity.

If your team wants a more structured way to handle verification and records, this identity verification checklist for compliance teams covers how to make the process repeatable.

Step 3: Find the customer in Shopify admin

  1. From your Shopify admin, click Customers.
  2. Search by email address, name or phone number.
  3. Open the matching profile.

Check for duplicates. A person who checked out as a guest and later created an account may appear twice, and the request covers both.

Step 4: Request the customer data

For an access or portability request, Shopify’s documented steps are: from Customers, open the profile, click More actions > Request customer data, then refresh the profile page to see the data. If you are the store owner, the data is also emailed to you (Shopify Help Center).

Step 4: Request the customer data

Then decide what to send. Shopify’s page says to provide the data if you have determined that is legally required or consistent with your store’s policies. That data covers what Shopify processes from the customer’s visits to your store. It does not cover data held in tools outside Shopify, so check those separately (see Step 6).

Step 5: Deliver the data securely

  • Send it to the verified email address, or through a secure download link, not as an open attachment to an unverified address.
  • Use a readable format, and include a short note explaining what the file contains.
  • Record the date you sent it and who sent it.

Step 6: Check apps and other systems

Shopify holds only part of what you may know about a customer. Look at your email marketing tool, helpdesk, reviews app, loyalty program and any spreadsheets. Apps listed on the Shopify App Store must subscribe to mandatory compliance webhooks such as customers/data_request and customers/redact, so they can receive and process requests (Shopify developer docs). Tools you connect outside Shopify are your responsibility to check by hand.

For a closer look at how apps use those two webhooks, see this overview of security plugins for Shopify.

Step 7: Handle erasure requests

For an erasure request, the process starts in the same customer profile. Shopify erases personal data such as the customer’s name and address, but the customer profile and order history remain in admin, and information such as what was sold and the date and time of the sale stays visible (Shopify Help Center).

Some data you may need to keep, for example for tax, accounting or an open dispute. If an order is still in progress or a legal obligation applies, tell the customer which data you are keeping and why. One merchant-focused write-up on Shopify’s move to a 10-day erasure cycle in 2026 also advises extra care with data under legal holds or ongoing service obligations (Power Commerce). Ask your attorney before erasing anything that could be needed later.

Step 8: Close the request

Send a short confirmation that the request is complete, and update your log with the outcome. Keep the log itself according to your retention policy. It should not carry more personal data than it needs.

Response deadlines at a glance

Law Standard deadline Extension Fee
GDPR (EU/UK) One calendar month from receipt Up to two further months for complex or numerous requests, with notice in the first month Free, except manifestly unfounded or excessive requests
CCPA/CPRA (California) 45 calendar days from receipt Up to 45 more days with notice and a reason Generally free

The GDPR figures come from this explainer on GDPR response time, which also notes the fee exception for manifestly unfounded or excessive requests under Article 12(5). The California figures come from the state regulation itself.

If you sell in several regions, a single request can fall under more than one law. The safe habit is to set your internal target to the shortest period that might apply to that customer, and confirm the details with your attorney.

Seven stages for a repeatable workflow

If you receive requests more than once or twice a year, write the process down once. ButterGrow describes a seven-stage workflow: intake, triage, identity verification, discovery, packaging, remediation and closure (ButterGrow). Mapped to Shopify:

Stage What you do in a Shopify store
Intake Log the request, date and channel
Triage Identify the request type and the law that may apply
Verification Confirm the requester through the account email
Discovery Request customer data in admin, then check apps and outside tools
Packaging Prepare a readable file and send it securely
Remediation Correct or erase data, and note what you must retain
Closure Confirm to the customer and update the log

Write who owns each stage. Agencies running several stores should keep one template per client so that nothing depends on one person’s memory.

Perspective: fewer requests start with better account pages

We build AccountCraft for merchants who get the same kind of request over and over: “What do you have on me?” and “Can you change my details?” Many of those emails exist only because customers have nowhere to look at their own information.

Shopify’s New Customer Accounts give you a clean base, and AccountCraft lets you build on it without code or theme changes. With the Block Builder you can add an update form or single field bound to customer metafields, a record list for things like pets or vehicles, and privacy consent and SMS consent blocks. Customers see and edit their data themselves, and it stays in Shopify. There is no separate customer database to search during a request.

We want to be clear about the limits. An app can help you collect, record and honor consent through Shopify’s customer privacy APIs. It does not make a store compliant, and the legal side stays with you. But a store where customers can self-serve has fewer manual tasks and a cleaner record when a formal request does arrive.

Ivan Signorile

Reduce the manual work with self-service account pages

A DSAR is not the only way customers deal with their data. Many only want to update a phone number, fix a birthday or withdraw marketing consent. If they can do that in their account, you never get the email.

With New Customer Accounts, this is how a merchant can set it up with AccountCraft:

  1. Define the customer fields you want customers to see as customer metafields. Our guide on letting customers edit Shopify customer metafields shows the setup.
  2. Add the fields to an account page with the Block Builder’s update form or single field blocks.
  3. Add a privacy consent block so customers can see and change their choice. Here is how to add a GDPR checkbox to New Customer Accounts.
  4. Use conditional rendering when a block should only appear for some customers, by customer tag, metafield, market, B2B status or account age.
  5. Use translations so customers in different markets read the page in their own language.

If you also need proof of what customers agreed to, read how to export consent records from Shopify. For store-wide privacy setup in the US, see our walkthrough of Shopify CCPA steps using the Customer Privacy API. If you are still moving off legacy customer accounts, our guide to Shopify New Customer Accounts covers the migration.

Install AccountCraft free

AccountCraft has a free plan, and the paid plans (Pro and Plus) are billed through Shopify. Check the Shopify App Store listing for current pricing. The app builds on official Shopify Customer Account UI Extensions, so you do not edit your theme or write code.

AccountCraft

Ready to build a self-service account page? Install AccountCraft free from the Shopify App Store, or see the plans on our site.

A pre-request checklist for your store

Set these up before the first request arrives:

  • A named person who owns privacy requests, and a backup.
  • A published way to reach you, linked from your privacy policy.
  • Permission settings so only the right staff can open customer data in admin.
  • A request log template with the fields from Step 1.
  • A list of every app and outside tool that stores customer data.
  • A short email template for verification, delivery and closure.
  • A review of consent records, so you can show what customers chose. Read about consent expiry for EU stores if you sell in Europe.

Run the process once on a test customer so you know where each screen is when a real request lands.

FAQ

How do I find a customer’s data in Shopify?

Go to Customers in your Shopify admin and open the customer profile. Click More actions > Request customer data, then refresh the page to see the data. If you are the store owner, the data is also sent to your email.

How long do I have to respond to a DSAR?

It depends on the law. GDPR generally gives one calendar month, extendable by up to two months for complex requests with notice. California gives 45 calendar days, extendable by 45 more with notice. Confirm the right deadline for your store with your attorney.

Does erasing a customer remove their orders from Shopify?

No. Shopify erases personal information such as name and address, but the customer profile and order history remain in admin, and details like what was sold and when stay visible. Check with your attorney or accountant about records you must keep.

Can I charge for a DSAR?

Under GDPR, responses are generally free, with a reasonable fee allowed only for manifestly unfounded or excessive requests. California responses are also generally free. Do not set a fee without legal advice.

Does AccountCraft handle DSARs for me?

No. AccountCraft gives customers account pages where they can view and edit their data and manage consent, using Shopify’s customer privacy APIs, and the data stays in Shopify. You still run formal requests from Shopify admin, and compliance remains your responsibility.

Sources