GDPR for Shopify stores: a practical UK guide
Under the UK GDPR, Shopify stores must collect only the data they need, have a lawful basis for using it, explain this in a privacy policy, get consent for marketing emails and non-essential cookies, keep data secure, and respond to requests from customers about their data. Most businesses also need to pay the ICO's data protection fee.
By Abdullah Ashraf, Shopify expert · Last updated: October 2026
Quick summary
- Clear privacy policy and lawful basis.
- Marketing consent must be opt-in, not pre-ticked.
- Respond to data requests within one month.
Your responsibilities
- Collect only data you need
- Explain how you use it in a privacy policy
- Keep it secure and limit access
- Delete it when no longer needed
- Pay the ICO data protection fee unless exempt
Marketing consent
Customers must actively opt in to marketing emails and SMS. In Shopify, make sure consent boxes aren't pre-ticked. Existing customers can sometimes receive similar product emails under the soft opt-in rule, with an easy unsubscribe.
Cookies
Get consent for non-essential cookies, such as analytics and ad pixels. Set up cookie consent.
Customer requests
Customers can ask to see, correct or delete their data. Respond within one month.
Frequently asked questions
Do I need to register with the ICO?
Most businesses pay a data protection fee. See if you do.
Do I need a privacy policy?
Yes. See what to include.
Official sources
- Data protection and your business (GOV.UK)
- Data protection fee (ICO)
- Cookies and similar technologies (ICO)
Checked September 2026. Rules change, so always check the latest official guidance.
Let's grow your store
Tell me what you sell and where you're stuck. You'll get honest advice and a fixed quote, even if we don't end up working together.