Question about mandatory GDPR webhooks for app review

[triplesingle]

With respect to the mandatory GDPR webhooks in this link (https://shopify.dev/docs/apps/build/privacy-law-compliance)

Is my understanding correct that my endpoint just needs to return a status code 200 and that I don't need any actual logic besides giving a 401 if the HMAC is wrong?

[Brett_Helium]

Hey @triplesingle,

Besides responding to the webhook with a 200 or 401, you will also need to make sure to need to actually complete the request by providing or redacting the indicated data within 30 days (https://shopify.dev/docs/apps/build/privacy-law-compliance#respond-to-compliance-webhooks)

[triplesingle]

Hi Brett, thanks for the advice!

My app does not collect any store or user data so I think I should be good with just providing the status code?