GDPR data subject access requests: how ecommerce stores should respond

A customer emails your support team: "I want to see all the personal data you hold about me." This is a Data Subject Access Request (DSAR). Under GDPR Article 15, you have 30 days to respond with a copy of all personal data you hold about that person, along with specific supplementary information. Failure to respond correctly risks regulatory investigation and fines.

DSAR volumes have increased significantly since GDPR enforcement began. High-profile enforcement actions have made consumers aware of their rights. For ecommerce stores selling to EU customers, handling DSARs correctly is not optional.

What a DSAR is under GDPR Article 15

Article 15 of the GDPR gives every data subject (any identified or identifiable natural person whose data you process) the right to obtain:

• Confirmation of whether you process personal data about them.
• A copy of the personal data being processed.
• The purposes of the processing.
• The categories of personal data concerned.
• The recipients or categories of recipients to whom the data has been or will be disclosed.
• The envisaged retention period for the data, or the criteria used to determine it.
• The existence of the right to rectification, erasure, restriction of processing and the right to object.
• The right to lodge a complaint with a supervisory authority.
• Where the data was not collected directly from the data subject, any available information about the source.
• The existence of automated decision-making, including profiling, and meaningful information about the logic involved.

A DSAR can be submitted in any format: email, a form on your website, a letter, a message to customer service. There is no formal requirement. If it is reasonably clear that someone is requesting access to their personal data, it is a DSAR and the clock starts.

The 30-day deadline

You must respond to a DSAR without undue delay and no later than one month (30 days) from receipt. If the request is complex or you receive a high volume of requests, you can extend by an additional two months (to a maximum of three months total). But you must notify the data subject within the first 30 days that you are extending and why.

The clock starts on the day you receive the request, not the day you process it or assign it to someone. A request received by your customer service email on October 1 must receive a substantive response by November 1, even if customer service does not flag it as a DSAR until October 15.

The response must be provided free of charge for the first request in any 12-month period. If requests are "manifestly unfounded or excessive," you can charge a reasonable fee or refuse to act, but the burden is on you to demonstrate that the request meets that threshold. It is a high bar.

Identity verification

Before providing personal data, you need to be reasonably confident you are providing it to the right person. You have the right to ask for sufficient information to verify the requester's identity. But the key word is "sufficient": you cannot use identity verification as a barrier to delay or discourage DSARs.

For ecommerce customers, appropriate verification typically includes:

• Asking for the email address associated with their account (then confirming they can access that email by sending a verification link).
• Asking for the name and an order number to cross-reference against your records.
• Verifying through a logged-in portal if you have one.

Do not ask for government-issued ID unless there is a genuine, specific reason the risk of providing data to the wrong person is high. The ICO's guidance is explicit: requiring disproportionate ID creates unnecessary barriers. The time spent on verification does not pause the 30-day clock; run verification in parallel with data gathering.

What personal data ecommerce stores hold

The scope of a DSAR response for an ecommerce store is broader than most teams initially realize. Personal data exists across multiple systems:

• Ecommerce platform (Shopify, WooCommerce, Magento, BigCommerce). Account information (name, email, phone, addresses), order history, payment method tokens (not full card numbers), reviews and product interactions, saved carts and wishlists.
• Email marketing platform (Klaviyo, Mailchimp, Omnisend). Email address, name, subscription preferences, email engagement history (opens, clicks), purchase behavior segmentation, SMS preferences.
• Customer service platform (Zendesk, Gorgias, Freshdesk). Support tickets and correspondence, return and refund history, notes left by support agents, any escalation records.
• CRM or loyalty platform. Loyalty points and tier history, referral data, customer lifetime value calculations, behavioral segments.
• Analytics platforms. If analytics is tied to user identity (e.g., Segment tracking identified users, or GA4 with User ID), browsing history, product views and conversion events associated with the user.
• Advertising platforms. If you use customer data for ad targeting (custom audiences uploaded to Meta, Google Customer Match), the data you have uploaded about this person may be in scope. When ad platforms process this data outside the EU, cross-border data transfer requirements add another layer of complexity.
• Fraud detection services. Risk scores, device fingerprints or behavioral patterns associated with the customer's account.
• Shipping carriers and logistics. If you retain delivery confirmation data or carrier tracking information, this may be in scope as data you hold (though data held exclusively by a carrier may be exempt).

You must collect data from all of these systems before responding. Responding with only your ecommerce platform data and ignoring email marketing, customer service and analytics is an incomplete response and a compliance failure.

DSAR response structure

A complete DSAR response has two parts: the data itself and the supplementary information required by Article 15.

The data portion can be delivered as a CSV or Excel export, a PDF, a structured data package or access to a self-service privacy portal. The format should be commonly used and machine-readable where possible (Article 20 portability rights specifically require machine-readable format).

The supplementary information should be written in plain language and cover:

• The categories of personal data you process about them and the specific data included in this response.
• The purposes for each category of processing and the legal basis (consent, legitimate interests, contract, legal obligation).
• How long you retain each category of data (or the criteria for determining retention). See our guide on data retention policies for ecommerce for setting appropriate timeframes.
• The third parties you share data with and for what purpose.
• Their rights: to rectification, erasure, restriction, objection, portability and complaint to the supervisory authority.
• The right to withdraw consent where processing is based on consent.
• Any automated decision-making used and how it works.

Common DSAR mistakes that lead to enforcement

Supervisory authorities receive complaints about DSAR handling regularly. The most common problems:

• Not responding at all. The most common enforcement trigger. DSARs often arrive in customer service inboxes and are not recognized as DSARs. They get logged as general inquiries and never escalated. Some simply go unanswered. The ICO can issue enforcement notices and fines for non-response.
• Missing the 30-day deadline. Responding on day 45 without notifying the data subject of extension by day 30 is a breach of Article 12. Even a substantive response delivered late can result in a formal complaint.
• Charging fees for routine requests. Multiple companies have attempted to charge "administrative fees" for DSAR processing. Unless a request is genuinely manifestly unfounded or excessive, this is not permitted.
• Incomplete responses. Responding with data from only one system when data exists across multiple systems is a partial response. The ICO's guidance is clear: you must search all systems where personal data about the requester might exist.
• Refusing to respond without justification. Companies sometimes refuse DSARs citing reasons like "this information is confidential" or "you are not a customer." Neither is a valid ground for refusing access to personal data you hold about someone. Exemptions exist (trade secrets, third-party data) but they must be applied specifically to the exempt portions, not used to refuse the entire request.
• Using identity verification as a barrier. Asking for a notarized copy of a passport or government-issued ID for a routine account access request is disproportionate. The ICO has specifically called this out as a tactic used to discourage DSARs.

Exemptions that actually apply

Some data can legitimately be withheld from a DSAR response:

• Third-party personal data. If your records about the requester contain other people's personal data (e.g., a customer service note that includes details about another customer's complaint that the requester was tangentially involved in), you can redact the third party's data. You should not redact your own employees' professional communications.
• Legal privilege. Legal advice and legal strategy documents involving the requester may be exempt in some jurisdictions.
• Crime detection and prevention. If providing data would compromise a fraud investigation involving the requester, specific elements may be exempt.
• Manifestly unfounded or excessive requests. If a requester has submitted many DSARs in a short period clearly to harass staff rather than to exercise genuine rights, you may be able to charge or refuse. Document your reasoning carefully and note this is a high threshold.

Automated DSAR tools

For stores receiving more than a handful of DSARs per month, manual handling becomes unscalable. Several tools exist to automate parts of the process:

• OneTrust DSAR management. Enterprise-grade workflow automation for receiving, verifying, processing and responding to DSARs. Integrates with many enterprise data systems.
• Osano DSR Automation. Privacy-focused tool with DSAR workflow automation and integrations for common SaaS platforms including Shopify and Klaviyo.
• Shopify's built-in tools. Shopify provides some built-in data export capability for customer data. The "Export personal data" feature in customer records gives you a starting point. But it only covers Shopify data, not external systems.
• Transcend. Privacy infrastructure platform with API integrations to automatically pull data from connected systems (Shopify, Klaviyo, Zendesk, analytics tools) and assemble a complete DSAR response.

Volume trends and enforcement

DSAR volumes have grown significantly since GDPR enforcement began. The UK ICO reported receiving over 4,000 data protection complaints in the 2022-2023 reporting year, with a significant portion related to DSAR non-compliance. Many of these resulted in enforcement notices against businesses that failed to respond.

Notable enforcement examples:

• The ICO issued enforcement notices against multiple companies including a major UK retailer for failure to respond to DSARs within the statutory deadline.
• The Spanish DPA (AEPD) fined a company 50,000 EUR for failing to respond to a DSAR within the required timeframe.
• The Irish DPC issued a reprimand and corrective order against a company for providing an incomplete DSAR response that omitted data held in a CRM system.

The trend is clear: supervisory authorities are actively enforcing DSAR obligations, not just data breach requirements. For ecommerce stores selling to EU customers, having a documented, tested DSAR process is essential.

Building your DSAR process

A minimum viable DSAR process for an ecommerce store:

• A dedicated privacy request intake mechanism: a privacy@yourstore.com email address or an online form linked from your privacy policy.
• Clear internal routing: whoever receives privacy emails knows to escalate DSARs immediately rather than treating them as support tickets.
• A tracking system: log every DSAR with date received, data subject identity, deadline date and status. A simple spreadsheet works for low volumes.
• Data gathering checklist: a list of every system where customer data is stored, with instructions for how to export data for a specific customer from each system.
• A response template that covers all required Article 15 supplementary information, customized with your actual retention periods, third-party sharing practices and legal bases.
• A verification process: a standard method for confirming the requester is who they claim to be, proportionate to the sensitivity of the data.

Frequently asked questions

How long do I have to respond to a GDPR data subject access request?

30 days from receipt. Extendable by 60 days for complex requests, but you must notify the requester within the first 30 days. The clock starts on receipt, not when you assign it internally.

Can I charge a fee for processing a DSAR?

No. The first request per 12 months must be free. You can only charge if requests are manifestly unfounded or excessive, but the burden of proof is on you.

What systems must I search for a DSAR?

All systems with personal data: ecommerce platform, email marketing (Klaviyo, Mailchimp), customer service (Zendesk, Gorgias), CRM, analytics, advertising platforms and fraud detection. Omitting a system is an incomplete response.

What is the most common DSAR compliance failure?

Not responding at all. DSARs arrive in support inboxes and are not recognized. They get logged as general inquiries and never escalated. The ICO issues enforcement notices for non-response.

What must a DSAR response include?

A copy of all personal data, plus supplementary information: processing purposes, data categories, recipients, retention periods, the data subject's rights (rectification, erasure, restriction, objection, complaint) and information about automated decision-making.

How do I verify a DSAR requester's identity?

For ecommerce: ask for the account email and send a verification link, or cross-reference name plus order number. Do not require government ID for routine requests. The ICO considers disproportionate verification a barrier tactic.

What format should DSAR responses use?

Machine-readable where possible: CSV, JSON or structured PDF. GDPR Article 20 portability rights require machine-readable format. A CSV export from each system plus a cover letter with supplementary information works for most stores.

Can I refuse a DSAR?

Only if manifestly unfounded or excessive. You cannot refuse because information is “confidential” or because the person is not a current customer. Exemptions (legal privilege, third-party data, fraud investigation) apply to specific portions, not entire requests.

Do US ecommerce stores need to handle DSARs?

If you sell to EU customers, yes. GDPR applies based on data subject location. CCPA/CPRA gives California consumers similar access rights. See our US state privacy laws guide for domestic obligations.

What tools automate DSAR processing?

OneTrust (enterprise), Osano (mid-market, Shopify/Klaviyo integrations), Transcend (API-based, pulls from multiple systems) and Shopify's built-in customer data export (Shopify data only).