Mandatory Webhooks - What should i return if i don't store shop data on our end?

Shopify Partner
15 0 2

As far as I understand we need to create these three endpoints that will make an app GDPR compliant

customers/data_request - we don't store any customer data on our systems, so what should we return here?
customers/redact - same, no customer data stored on our systems...
shop/redact - does shopify consider user's shop url and oauth token as user data, in that case should we purge that from our systems? (this is the only data we save in our database)

Reply 1 (1)

Shopify Staff (Retired)
63 10 15

Hi Saptarshi, to make your app GDPR complaint you must subscribe to the 3 mandatory GDPR webhooks, and ensure you are returning a 200-level response when receiving these webhooks. Even if you do not store any customer data, you should return a 2XX status code when receiving the webhook.

You can read more on mandatory GDPR webhooks here:


mrad | Developer @ Shopify 
 - Was my reply helpful? Click Like to let me know! 
 - Was your question answered? Mark it as an Accepted Solution
 - To learn more visit or the Shopify Web Design and Development Blog