Does a Shopify store shipping to the EU need a GDPR representative?

This guide is for you if you run an online store from outside the EU, on Shopify, WooCommerce, BigCommerce or Etsy, and people in the EU order from you. In most cases you need to name an EU representative. That is a person or company based in an EU country where your customers are, which your customers and officials can contact about how you handle their data. You appoint it in writing and list it in your store's privacy policy.

Does the GDPR apply to your store?

For most stores that take EU orders, yes. The GDPR is the EU's data protection law. It sets rules for handling personal data, meaning information about a person who can be identified, such as a name, email address or delivery address.

It reaches a store outside the EU that has no real base there, if the store does either of two things:^[1]

1. It offers goods to people in the EU. Payment is not the test, so a free sample counts too.^[1]
2. It monitors their behaviour in the EU, meaning it tracks what they do for a purpose, such as choosing which ads to show them.^[2]

If either applies, you must name in writing a representative established in an EU country where your customers or tracked visitors are, unless a narrow exemption fits.^[1]

The rule reaches only those not "established" in the EU. The GDPR's introductory notes say establishment implies "the effective and real exercise of activity through stable arrangements".^[1] In our view, your own office or company in the EU is the usual example. A shipping zone or a euro price list is not.

What counts as offering goods to the EU?

In our view, shipping to EU countries is a strong signal. The European Data Protection Board (EDPB), which publishes official guidance on the GDPR, lists signs that a business intends to sell to people in the EU. One of them is that it "offers the delivery of goods in EU Member States".^[2]

Others include naming an EU country with the offer, and marketing campaigns aimed at an EU audience. Another is using a language or currency other than the one generally used in your own country, especially an EU country's.^[2]

The EDPB weighs these signs together, since some may not be a clear sign on their own.^[2] A website that people in the EU can merely reach is not enough.^[2]

A store with an EU shipping zone and a checkout that takes EU orders makes the offer plain. Shopify Markets is not named in the guidance.^[2] But an EU market with euro prices, EU shipping rates and ads aimed at EU countries brings several of the EDPB's signs together.^[2]

What counts as monitoring?

Tracking counts when you use it to follow what people do, for a purpose. The EDPB's list of monitoring includes behavioural advertising, meaning ads chosen from what someone has done online. It also includes online tracking through cookies or other techniques.^[2]

Monitoring implies "a specific purpose in mind" for the data about someone's behaviour. The EDPB does not treat every online collection or analysis of data as monitoring automatically.^[2]

The last column is Gabsor's assessment. The EDPB's guidance names none of these apps.^[2]

In our view, monitoring matters most for a store that does not ship to the EU but runs ad pixels on EU visitors.

Does Shopify take care of this for you?

Not this part. Shopify's data processing addendum is its contract with you about your customers' personal data. In it, Shopify says it handles that data as your processor.^[3] A processor is a person or organisation that handles personal data on someone else's behalf.^[1]

There is one exception. For what Shopify calls Enhanced Services, it acts as a controller itself.^[3] A controller is whoever decides why and how personal data is used.^[1] In our view, outside that exception, you are the controller of your store's orders and mailing list.

The GDPR requires a processor to work under a contract, or another legal act, that binds it to the controller.^[1] Shopify's addendum sets out its processor role, and it does not mention an EU representative.^[3] Nor do the two Shopify help pages we read, on the GDPR and on store policies.^[4][5]

Shopify's GDPR help page tells merchants that some steps are theirs to take.^[4] The duty to name a representative falls on the controller or processor outside the EU.^[1] For your orders and mailing list that is you, so this is one of your steps.

The same reading applies on Etsy or Amazon: you remain responsible for buyer data you use for your own marketing, such as an email list, whatever the marketplace's role. If you run a marketplace yourself, the Digital Services Act, another EU law, may also apply; see our DSA legal representative page.

Are you exempt if you are small or get few EU orders?

Probably not. Size is not the test, and the exemption is narrow. Here are three things store owners often say, and what the rules say. The right column adds our reading where the rules do not settle it.

The exemption applies only if all three of these are true:^[1]

1. Your handling of the data is occasional.
2. It does not include, on a large scale, the especially sensitive types of data the GDPR lists separately, or data about criminal convictions.
3. It is unlikely to create a risk for the people whose data it is.

The EDPB says handling data is occasional only if it is not done regularly and happens outside the normal course of your business.^[2] In our view, selling is the normal course of a store's business. A store that takes EU orders every month handles that data regularly, however few the orders.

What if you ship to the EU only on request?

This is a different question from the exemption above. Say you have no EU shipping zone. A customer in Dublin emails to ask for one order, and you agree. The EDPB says goods provided "inadvertently or incidentally" to a person in the EU do not bring the related processing within the GDPR's reach.^[2]

In our view, a one-off order like that is close to incidental. Routine requests look more like an offer. Check your tracking separately: tracking EU visitors for ads is a different trigger.^[1]

Not sure whether this applies to you? Take the 3-minute check →

What happens if you skip it?

In our view, the first consequence for a small store is rarely a fine. It is more often a question. Say a payment provider, a marketplace or an EU wholesale customer asks for your EU representative during a review. You have nothing to give them.

Fines exist as well. The cap for not naming a required representative is €10 million. For a business, it is 2% of worldwide turnover, meaning revenue, in the last financial year, if that is higher.^[1]

There is a published case, but not against a store. The Dutch data protection authority is the official body that enforces the GDPR in the Netherlands. On 12 May 2021, it announced a €525,000 fine against LocateFamily.com for having no EU representative.^[6][7] LocateFamily is a people-search website. Arthur Cox reports that it could not rely on the "occasional" exemption, because its processing of personal data was regular.^[8]

What does a representative do for your store?

It is your store's contact point in the EU, for customers and officials. Say a customer in Munich wants a copy of the data you hold about her. She can write to your representative, instead of or as well as to you.^[1] The representative passes the request on; answering it stays your job.^[2]

• It is named in your privacy policy, with its contact details, next to yours.^[1]
• It is the address for data protection authorities, the official bodies that enforce the GDPR in each EU country. An authority can contact it about any of your GDPR duties.^[2]
• It keeps your record of processing too, alongside you. That is your list of what personal data you handle and why.^[1]
• It does not take over your responsibility. Appointing one does not change your own liability, meaning your legal responsibility.^[2] An authority can send its orders and fines against you to the representative, but they stay yours.^[2]

See what Gabsor's GDPR representative service includes.

Do you need a UK representative too?

It depends on where your store is and where you sell. The UK has its own version of the GDPR, with its own rule requiring a representative in the United Kingdom.^[9] It has the same exemption for occasional, low-risk handling.^[9]

In our view, a Manchester store with no EU base that runs a German shipping zone and checkout needs an EU representative, because to the EU it is a business outside the EU.^[1] A Toronto store with shipping zones and checkouts for the UK and France, and no base in either, needs both representatives.^[1][10]

Our reading of the two rules, assuming no exemption applies.

Two rules mean two appointments: one in the EU and one in the UK.

How to appoint one, in five steps

1. Check your scope. In your Shopify admin, look at your shipping zones and markets. List the apps that track visitors, such as pixels and email flows. Then work through Figure 1, or take the 3-minute self-assessment.
2. Choose a representative established in an EU country where your customers or tracked visitors are.^[1] If you also sell to people in the UK and have no base there, choose one in the UK too.^[9]
3. Make the appointment in writing, as the GDPR requires.^[1] In practice you sign a letter of appointment. Keep a copy.
4. Add the line to your privacy policy. It must give your representative's name and contact details.^[1] In Shopify, go to Settings > Policies, then click the privacy policy in the Written policies section.^[5] Neither Shopify help page we read mentions a representative, so add the line yourself.^[4][5] We suggest: "EU representative: [name], [postal address], [email]." If you use Shopify's automatic policy updates, check that the line is still there after each update.
5. Keep your record of processing. It must name your representative.^[1] List what you collect, why, and which apps receive it, such as Klaviyo or Meta. Businesses with fewer than 250 staff can skip the record only if their handling is occasional, unlikely to create a risk and free of sensitive or criminal-record data.^[1] As above, a store that takes orders regularly does not meet that.

What it costs

Gabsor's Essential plan, for companies under $500k annual revenue, starts from $79/month, billed annually.