GDPR accuracy and data minimisation for a Shopify merchant

Duplicate customer records are a data quality problem. In some countries they are also a data protection one. This page sets out what two of the data protection principles say in the regulator’s own words, and where a duplicate customer meets them.

What the two principles say

The principles come from Article 5 of the GDPR, and the UK version has the same wording. The UK regulator, the Information Commissioner’s Office (ICO), lists them in its guide to the data protection principles. We did not find an EU regulator page with matching guidance, so the quotes below are from the ICO and from the text of Article 5.

• Data minimisation. Personal data must be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed”.
• Accuracy. Personal data must be “accurate and, where necessary, kept up to date”, and “every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay”.

How much effort counts as reasonable

The ICO says the effort depends on the stakes: “The more important it is that the personal data is accurate, the greater the effort you should put” into making sure it is. Its example of keeping data up to date is customer addresses: “you should update your records for customers’ changes of address so that goods are delivered to the correct location”.

So a store that sends parcels needs its delivery details right. A record used only for a newsletter carries different stakes. The regulator’s pages do not say how much effort a customer list needs, and we do not set a standard here.

Where duplicates meet the principles

The ICO pages do not mention merging or duplicate records, so what follows is our reasoning.

• Accuracy. A person with two profiles has two records. If their address changes, you can correct one and leave the other wrong. One record per person leaves fewer records to keep right.
• Data minimisation. The ICO’s checklist says “We periodically review the data we hold, and delete anything we don’t need”. A second copy of the same person’s details is data you may not need.

A merge is not free of risk. Shopify’s help page says “After the profiles are merged, you can’t reverse the process”. A merge combines notes, tags, addresses and other details, and if the customer is subscribed in one profile but not in the other, the merged profile is subscribed. A wrong merge makes the record less accurate, so review each pair before you combine it. How to merge customers in Shopify covers the steps.

Erasure is different from deleting a profile in Shopify

Shopify’s help page treats erasing personal data and deleting a customer profile as different things. Erasing personal data redacts details such as name, email, phone and address, and the page says “the profile and order history remain in your Shopify admin”.

Deleting a customer profile can’t be undone. Shopify blocks it for a profile with a pending GDPR erasure, an undelivered scheduled gift card, a past or current subscription, or associated orders. This page makes no claim about how fast you must respond to an erasure request. For that, ask your lawyer or your regulator.

Keeping a record of changes

The ICO says it is acceptable to keep records of mistakes, provided those records are not misleading about the facts. As a matter of good practice, it suggests keeping a note of any challenges to the accuracy of the personal data.

In practice, a note of what you merged and why helps you answer a question later. A merge cannot be reversed, so the record is how you show what happened. MergeGuard’s History is one such record.

Check your own jurisdiction

Rules differ by country and by the kind of data you hold. The ICO guidance applies in the UK, and the GDPR applies in the EU. Shopify says merchants have their own steps to take beyond what Shopify does. Ask a local lawyer who knows data protection law which rules apply to your store.