Handle customer data deletion and access requests across every system, before the deadline
Updated · By Ecomsellertool editorial team
Put every request into one case with its deadline, check identity, then list each system holding that customer's data and decide per system: delete, anonymize or keep. Hold back records you must keep, such as tax and order records, with a written reason. A person approves the holds and the reply. This is not legal advice.
- EU: reply without undue delay, in principle within 1 month, says the European Commission (checked November 6, 2026). The EDPB allows two more months for complex requests if you say so in the first month.
- UK: since February 5, 2026, the month runs from the latest of receipt, identity information arriving or a fee being paid, under the Data (Use and Access) Act 2025.
- California: confirm receipt within 10 business days and respond within 45 calendar days. That clock starts on receipt, however long verification takes, with up to 90 days in total if you give notice and a reason.
- Shopify gives you 10 days to cancel an erasure and sends the customers/redact webhook 10 days after the request. Apps then have 30 days. Order history stays in your admin.
- Shopify says it is your responsibility to contact other companies you shared the customer's data with, so the list of systems is the real work.
- Not legal advice: a person and your counsel decide which law applies and what must be kept.
The step map: who runs each step
Trigger: A customer asks by email, form, phone or chat for a copy of their data or for it to be deleted, or a Shopify customers/data_request or customers/redact webhook arrives at your app.
| Step | What happens | Who runs it |
|---|---|---|
| 1 | Each request becomes one case with the date received, the channel, the type (access, deletion or opt-out) and the customer's stated location. Duplicates join the open case. | Rule |
| 2 | An AI model flags messages in the support inbox that look like a privacy request but did not come through the form. A person confirms the flag before a clock is set. | AI model |
| 3 | The workflow sets the dates from the table your counsel approved, sends the acknowledgment and opens a task ahead of each date. | Rule |
| 4 | It matches what the requester gave against what you already hold, such as email, order number and postal code. A person reviews a weak match and decides whether to ask for more. | Person |
| 5 | It searches each system on the list by customer ID, email and phone, saves those lookup keys to the case and records what each system holds, before anything is erased. | Rule |
| 6 | A person marks each system delete, anonymize or keep, with the reason for any hold, such as tax records or an open chargeback. | Person |
| 7 | The workflow runs the approved actions, sends deletion notices to vendors with no API, chases confirmations and marks each system done only when it reads back a result. | Rule |
| 8 | A person approves the reply and the access pack. The workflow sends it and keeps a log of the request and the response, with no more personal data than the log needs. | Person |
4 rule steps · 1 AI model step · 3 person steps. A rule follows fixed logic you approve; an AI model handles messy input and its output is checked by rules; a person makes the calls listed below.
What stays with a person
- Which law applies to this customer, with your counsel's table behind it
- Accepting or refusing an identity match, especially when a stranger could be asking for someone else's data
- Every hold on tax, order, fraud or dispute records, and the date it is reviewed
- Erasing a Shopify customer who has an open subscription, a pre-order or a recent order still on its way
- Approving the reply, any refusal and any extension notice
Which tools can run it
- A shared tracker, a form and calendar reminders, for a few requests a year
- Your helpdesk's forms and macros for intake, with a system checklist on each ticket
- Zapier, Make or n8n to set dates, search systems and call vendor deletion APIs, with a person approving each run
- A small custom app on your accounts that receives Shopify's compliance webhooks, keeps the case log and reads results back
Systems it connects
- Shopify customers, orders and apps
- Amazon reports and your stored exports
- Helpdesk such as Gorgias or Zendesk
- Email marketing such as Klaviyo
- 3PL or warehouse system
- QuickBooks, Xero or another accounting system
- Case log and task tracker
Build size: Medium
The dates are simple. The work is finding every copy of the customer's data, and each vendor deletes in its own way.
A customer emails: "delete everything you have on me." Support clicks erase in Shopify and closes the ticket. Weeks later that person gets a marketing email, and their address is still in the 3PL's order file. Nobody meant any harm; there was just no list. This recipe is that list, plus the dates. One request becomes one case, every system gets a decision, and the reply goes out on time. It is one page of our automation library, and it covers the operations side only. Your counsel owns the law.
What should happen in each system when a customer asks for deletion?
Use this table as your starting list. Each row is one system, what it usually holds, a starting decision for counsel to change, the check a workflow can run and the decision that stays with a person. The vendor details were checked on November 6, 2026 on the pages linked below the table. Add every other place your team keeps customer data, such as shared spreadsheets, chat threads and ad audiences.
| System | Data it usually holds | Starting decision | Check the workflow can run | What a person decides |
|---|---|---|---|---|
| Shopify | Profile, addresses, orders, notes, data in apps | Anonymize with Shopify's erasure; order history stays | Customer ID and order IDs saved first; open subscriptions and pre-orders flagged; erasure status read back after the 10 days | Approving the erasure; cancelling it in the 10 days if it was wrong |
| Amazon-fulfilled orders | Amazon holds the buyer record. You hold reports, exports and warehouse files | Delete or anonymize your copies; you cannot act on Amazon's | Search stored exports by order ID; flag buyer data in your own API store past 30 days after delivery | How the reply describes data Amazon holds; any copy kept for tax |
| Helpdesk | Tickets, messages, attachments, internal notes | Delete the customer; review what stays in notes | Second deletion step done where the vendor has one; open tickets listed first | Tickets needed for an open dispute or a claim |
| Email marketing | Profile, events, consent history | Delete | One deletion call per identifier; completion date read back | How you keep a do-not-email record for that address, if you need one |
| 3PL | Order files, labels, addresses, return records | Ask them to delete or anonymize, as your contract allows | Notice sent, reply received, overdue reminders; no open shipment for that customer | Contract terms; what happens to a shipment still in progress |
| Accounting | Invoices, credit notes, customer names, payment references | Keep, with a written reason and a review date | Hold recorded; customer removed from non-accounting exports | The retention period for each country, with your tax adviser |
| Fraud and dispute records | Chargeback evidence, risk notes, blocked-customer lists | Keep only while there is a stated reason, then review | Open disputes found before any deletion; review date set | Whether the reason still holds |
Shopify. Start from the customer profile with More actions, then Request customer data or Erase personal data. You have 10 days to cancel. Shopify says what was sold and the date of the sale stay visible in your admin, and remaining pre-authorized payments on pre-orders and subscriptions are not charged, so a person should look before submitting. Erasing is different from deleting a profile, and a profile with orders cannot be deleted. Erasure does not reach data Shopify holds through a customer's own Shop or Shop Pay relationship.
Shopify apps. Every App Store app must subscribe to three compliance webhooks: customers/data_request, customers/redact and shop/redact. An app answers with a 200-series status and completes the action within 30 days, and Shopify says not to complete it if you are legally required to keep the data. Those webhooks tell apps what to do. They do not reach your 3PL or your accounting file, and Shopify says contacting those companies is your responsibility.
Amazon. Amazon's Access Orders PII page shows nearly all personal data unavailable on US Amazon-fulfilled orders, with postal code as the exception under one role, and access elsewhere depends on role, country and order status. Its Data Protection Policy tells solution providers to keep such data no longer than 30 days after order delivery unless the law requires otherwise. The policy does not clearly say how it applies to an app a seller builds only for itself, so ask counsel. We could not read Amazon's consumer privacy notice today, so we make no claim about how a buyer asks Amazon directly.
Helpdesk and email. Gorgias says deleting a customer does not delete them in other integrated apps, and information can remain in internal notes. Zendesk says a further step is needed after deleting a user, which is the permanent deletion, and it cannot be undone. Klaviyo's data request guide says deletion cannot be undone, redacts identifying event data and shows a completion date. Its API accepts one identifier per call and runs asynchronously, so the workflow must read the result back rather than trust the first response.
Accounting. Retention periods come from tax rules. The IRS's general rule is 3 years for income tax records, with longer periods in named cases. GOV.UK says a UK limited company keeps records for 6 years from the end of the last financial year they relate to, or longer in some cases. We did not check other countries. This is not tax advice, so have your adviser set the period per country.
How do you calculate the deadline for each request?
This is the table to load into the workflow, once counsel confirms it. The sources state these clocks differently, and the biggest difference is what happens while you wait for proof of identity.
| Clock | Starts | Deadline | Longer if | Does waiting for identity pause it? |
|---|---|---|---|---|
| EU GDPR request | Day received | Without undue delay, in principle within 1 month | Two more months if complex, told within the first month | Yes, per an example in the EDPB access guidelines |
| UK GDPR request | Latest of receipt, identity information received or fee paid | One month from then | Two more months for complexity or number of requests, with notice and reasons inside the first month | Yes. Access requests also stop while you wait for clarification you reasonably need |
| California: confirm receipt | Day received | 10 business days, with how you will process it | None stated | No |
| California: delete or know | Day received | 45 calendar days | Up to 90 in total, with notice and a reason | No. If you cannot verify in time, you may deny |
| California: opt out of sale or sharing | Day received | As soon as feasible, at most 15 business days | None stated | No identity check may be required |
| Shopify erasure | Your request | 10 days to cancel; customers/redact is sent 10 days after | Held until delivery if the customer is a scheduled gift card's recipient | Not applicable |
| Shopify app duty | Webhook received | 30 days to complete | Not done if the law requires keeping the data | Not applicable |
Shopify shop/redact | App uninstalled | Sent 48 hours later; 30 days to complete | None stated | Not applicable |
Here is a worked example with a made-up request received on Friday, January 29, 2027. It is illustrative only and not a client case.
| Clock | Date | How we got it |
|---|---|---|
| EU, one month | Monday, March 1, 2027 | February has no 29th in 2027, so the EDPB's rule gives the last day of the month, February 28. That is a Sunday, so the next working day |
| EU, extended | About April 29, 2027 | Two further months; have counsel confirm the count |
| UK, one month | Depends on the start | If identity information arrives on February 3, the month starts there. We could not read the ICO's guidance on counting, so ask counsel for the end date |
| California, confirm | Friday, February 12, 2027 | 10 business days, assuming no holiday falls in that stretch |
| California, respond | Work to Friday, March 12, 2027 | 45 days after receipt is Monday, March 15. The period begins on the day of receipt, so we suggest an earlier target |
| California, longest | About April 29, 2027 | 90 days from receipt, with notice and a reason sent first |
| Shopify | About February 8, then March 10, 2027 | Webhook 10 days after an erasure submitted that day, then 30 days for apps |
One trap sits in that table. If you start the Shopify erasure late, the 10-day wait can use up most of your month before your apps even hear about it. So start it early, once identity and holds are settled. The EDPB counting rule comes from its guidance on access requests, so confirm with counsel that you use it for deletions as well.
Which records can you keep, and for how long?
Holding a record back is a decision with a reason, not a default. The Commission says erasure is not required where data is needed to comply with a legal obligation or for legal claims, among other grounds, and UK Article 17 has matching text. California's Attorney General lists exceptions such as completing a transaction, certain security practices, and legal obligations or claims. None of those pages gives a list for fraud records, so your counsel should sign off that row.
California's regulations add working rules a workflow can enforce. When you deny in part, you explain why, delete what the exception does not cover and use the rest only for that exception. Backups may wait until they are restored or next used. You keep a log of requests and responses for at least 24 months, and that log needs only the date, the type, how it was made, the response and any reason for denial. Personal data collected just for verification is deleted as soon as practical. Passing the deletion on matters too: California requires notice to service providers and to third parties you sold or shared the data with, and the EDPB and UK Article 19 say to tell recipients.
How do you check identity without creating a new risk?
California's regulations say to match what the person gives you against data you already hold before asking for more, and to avoid collecting sensitive identifiers unless necessary. Stricter checks fit higher risk, and a request to see data is usually riskier than an opt-out. A good first check is a reply from the email on the account plus an order number and a postal code. Do not ask everyone for a passport copy by default. The Commission lets you ask for more information to confirm identity, and the EDPB and UK law tie that to reasonable doubts about who is asking.
Access requests need one more guard, because the pack itself is sensitive. In California the regulations cover the 12 months before the request by default, and a consumer can ask for data going back to January 1, 2022, unless that is impossible or involves disproportionate effort. The same section bars sending certain identifiers, such as Social Security and financial account numbers. So a person reviews the pack before it leaves, and the workflow never attaches it to an unverified thread.
Which law applies, and what did we not check?
Which law applies is a question for counsel, and the two California agencies do not state the revenue test the same way. The Attorney General's page, updated August 28, 2026, says over $25 million. The CPPA's FAQ says $26.625 million or more, adjusted from January 1, 2025. Both also list 100,000 or more California residents or households, and a test based on 50% of revenue. Record which figure your counsel uses.
We did not check other US state privacy laws or national rules inside the EU. The UK regulator's guidance blocked our reader today, so the UK rows come from the legislation, not the ICO's explanation of it. Read the ICO's pages before you set your UK dates, and add your own rows for any other place you sell.
What should stay with a person?
Rules can set a date, search a system, call an API and chase a vendor. They should not decide whether two records are the same human, whether a chargeback still justifies a hold, or what a refusal says. Those calls carry the real risk, in both directions: deleting the wrong customer cannot be undone, and sending a pack to the wrong person is a new problem of its own. Requests also tend to arrive through ordinary support, so make sure your ticket triage routes them here rather than to a macro. Holds should line up with your chargeback evidence workflow, since a dispute can open after a deletion request does.
Which tool should run it?
| Level | Fits when | What to watch |
|---|---|---|
| A tracker and a form | A few requests a year and few systems | Someone must own the dates, and the list goes stale when you add an app |
| Helpdesk forms and macros | Requests already arrive there | The ticket holds personal data too, so plan for what happens to it |
| Zapier, Make or n8n | Several vendors with deletion APIs, and a person approving each run | A failed step must stop and alert; see our Zapier vs Make vs n8n comparison |
| Custom code on your accounts | Your own Shopify app, many systems, a log and read-backs | Can run on Ecomsellertool Growth OS beside your order and support workflows |
Who builds a data request workflow for an ecommerce brand?
Ecomsellertool builds the operations layer for workflows like this, on your own accounts, and we have built on Amazon's seller APIs since 2017. We map every system that holds customer data, then build the case log, the dates, the vendor steps and the approvals your counsel asks for. Legal decisions stay with you. Send a project brief below, or read how our workflow automation service works.
None of our case studies is a privacy project, so here is the nearest shipped work, and why it applies:
- Next-step alerts instead of manual chasing. For EzBookPrep we built alerts for the next action on each book, replacing the manual follow-ups that had made the client the bottleneck, along with customer and vendor management and return or refund processing. A request case with vendor steps works the same way.
- Several systems, one record. For Pacific Prep we connected Amazon, Shopify and ShipStation in one warehouse system. Knowing which system holds what is where this workflow starts.
You keep your accounts, your data and the custom code we build; the Growth OS base is licensed to you.
Get this workflow built
Send us your version of this workflow
Describe the workflow you want automated. We reply with a written plan: scope, timeline and a fixed price.
Frequently asked questions
How long do I have to respond to a customer data deletion request?
It depends on the law. The European Commission says without undue delay and in principle within 1 month in the EU. UK law gives one month from the latest of receipt, identity information or a fee. California gives 10 business days to confirm and 45 calendar days to respond, extendable to 90 with notice. Your counsel confirms which applies to each customer.
Does waiting for ID stop the deadline?
Not everywhere. UK law starts the month when identity information arrives, and the EDPB's access guidelines describe a suspension until a controller can verify identity. California's regulations start the 45 days on receipt, regardless of the time needed to verify. If you cannot verify in that time, you may deny the request there.
Do I have to delete order and tax records when a customer asks?
Usually not all of them, but a person with counsel should decide. The EU and UK texts say erasure does not apply where processing is needed for a legal obligation or legal claims, and California's Attorney General lists similar exceptions. Hold only what is needed, record why, and delete the rest. California's regulations also limit what you may use held data for.
Does Shopify's erasure delete the customer everywhere?
No. Shopify redacts details such as name and address in your store, while order history and what was sold stay visible. It can reach apps you installed through your admin, and it says contacting other companies you shared the data with is your responsibility. Erasure also cancels subscription contracts and stops the remaining pre-authorized payments, so check those first.
What do I do about customers who bought through Amazon?
Handle the copies you hold, such as reports, exports and warehouse files. Amazon's documentation shows nearly all buyer personal data is unavailable through its API on US Amazon-fulfilled orders, and its Data Protection Policy limits how long solution providers keep it. We could not read Amazon's consumer privacy notice, so ask counsel how your reply should describe data Amazon holds.
Can this be fully automated?
The intake, dates, searches, vendor calls and chasing can run on rules. Identity decisions, holds, refusals and the final reply should stay with a person, because a wrong deletion cannot be undone and a wrong disclosure hands a stranger someone's data. Klaviyo and Zendesk both say their permanent deletions cannot be reversed.
