Data Privacy Checklist

Quarterly privacy review for DTC and marketplace merchants — covers data mapping across Shopify and Klaviyo, consent, DSR handling, vendor DPAs, and breach response under GDPR, CCPA/CPRA, and TCPA.

Use this workflow
1

Data Mapping and Consent

  1. Inventory PII across Shopify, Klaviyo, and Gorgias

    • List every system that stores customer PII — checkout (Shopify), email/SMS (Klaviyo, Postscript), helpdesk (Gorgias), reviews (Yotpo), subscription (Recharge), 3PL portal. Note data category, retention period, and lawful basis. Hidden long-tail apps (loyalty, quizzes, abandoned-cart popups) are the usual blind spot.

    Collects file
  2. Audit the cookie consent banner configuration

    • Open OneTrust, Cookiebot, or Termly and verify pixels (Meta, TikTok, GA4) are blocked until consent. Check that Global Privacy Control (GPC) signals are honored — required by CPRA and Colorado. Run the site in an EU IP to confirm reject-all parity with accept-all.

  3. Verify TCPA opt-in language on SMS sign-up

    • Postscript and Attentive forms must capture express written consent with disclosure of message frequency, msg/data rates, and STOP/HELP keywords. Pre-checked boxes and checkout-bundled consent are TCPA class-action triggers.

  4. Confirm Do Not Sell or Share link placement

    • CPRA, Virginia, Colorado, and Connecticut require an accessible opt-out link in the footer. Test that clicking it triggers an actual signal to ad pixels and Klaviyo profiles, not just a cosmetic confirmation.

  5. Archive consent records for the quarter

    • Export consent logs from the CMP and from Postscript/Attentive. Retention periods vary by jurisdiction — keep at least 4 years for TCPA defense.

2

Storage and Security Controls

  1. Enforce 2FA on Shopify admin and Klaviyo

    • Confirm every staff account has 2FA enabled in Shopify, Klaviyo, Gorgias, and the ad platforms. Remove dormant collaborator accounts from agencies and former contractors — orphaned access is the most common breach vector for SMB merchants.

  2. Review Shopify staff permissions and roles

    • CX agents rarely need export or apps permissions. Limit to Orders + Customers (view). Designers and developers should use the Themes role, not full admin.

  3. Audit installed apps for data scope creep

    • Review every Shopify app's data permissions in Settings → Apps. Uninstall anything unused — uninstalled apps still process data per their privacy policy until you request deletion. Flag apps requesting customer PII without a clear feature need.

  4. Lock down staging and dev environments

    • Shopify development stores and theme previews must not contain real customer data. Add password protection and noindex tags. A staging URL with real PII indexed by Google triggers state breach-notification obligations.

  5. Verify subprocessor encryption commitments

    • Pull the latest DPA from each major subprocessor (Klaviyo, Gorgias, Recharge, 3PL) and confirm encryption-in-transit and at-rest commitments. Flag any vendor without a SOC 2 Type II report.

3

Data Subject Request Handling

  1. Classify the incoming DSR request type

    • Customer requests arrive via privacy@ inbox, Gorgias, or the privacy-page form. Classify the type — different obligations and clocks apply (CCPA gives 45 days, GDPR gives 30).

    Collects list
  2. Verify the requester's identity

    • Match the email of record against an order in Shopify, or send a verification link to the email on file. Don't release data based on an unauthenticated form submission — fulfilling a fraudulent DSR is itself a breach.

  3. Export customer data from connected systems

    • Pull profile, order, and event data from Shopify, Klaviyo, Recharge, and Gorgias. Combine into a single human-readable export. Klaviyo's profile export does not include unsubscribed-list events — pull those separately.

  4. Delete or anonymize the customer record

    • Use Shopify's Customer Data Erasure request, then propagate to Klaviyo, Gorgias, Recharge, and the 3PL. Order records may be retained for tax purposes (typically 7 years) — anonymize PII rather than full delete on transactional records.

  5. Send the response within the regulatory window

    • Reply within 30 days for GDPR / 45 days for CCPA. Document the action taken in the DSR log — regulators ask for the log, not the underlying data, in audits.

4

Vendor and Third-Party Management

  1. Refresh the published subprocessor list

    • Privacy policy must list every subprocessor that touches PII (Klaviyo, Gorgias, Recharge, Shopify, ad platforms, 3PL). EU-facing brands must give advance notice of new subprocessors per GDPR Art. 28.

  2. Collect signed DPAs from new vendors

    • Any vendor onboarded this quarter that processes customer data needs a Data Processing Agreement on file before going live. Most major SaaS vendors auto-accept their standard DPA in account settings — confirm acceptance is logged.

    Collects file
  3. Review vendor SOC 2 reports for findings

    • Request the most recent SOC 2 Type II from each critical vendor. Skim the exceptions section — vendors with material findings around access control or encryption should be flagged for re-evaluation.

  4. Verify EU transfer mechanisms (SCCs or DPF)

    • If you sell to EU customers, US-based subprocessors need either Standard Contractual Clauses or EU-US Data Privacy Framework certification. DPF participation is verifiable on dataprivacyframework.gov — Klaviyo, Shopify, and Gorgias are all certified, but check anything smaller.

  5. Notify customers of subprocessor changes

    • Material changes to the subprocessor list trigger a privacy-policy update notice. Email-list customers should receive a notification per CAN-SPAM and your own policy commitments.

5

Incident Response and Breach Notification

  1. Refresh the incident response runbook

    • Update the on-call roster, escalation tree, and counsel contact. Include Shopify Trust contact, Klaviyo support tier, and your cyber-insurance hotline. A runbook with a stale on-call list is the most common Day-Zero failure.

  2. Run a tabletop exercise with the on-call team

    • Walk through a realistic scenario — leaked Shopify Storefront API token exposing customer profiles, or a phished Klaviyo admin. Time the team to first decision. Document gaps in runbook coverage.

  3. Triage the incident's PII exposure scope

    • For any incident reported this quarter, document what data was exposed and to whom. Notification obligations turn on whether identifiable PII was accessed by an unauthorized party — not on whether systems were merely accessible.

    Collects list Collects paragraph
  4. Notify regulators and affected customers

    • GDPR requires supervisory authority notification within 72 hours of awareness; most US states require notification to affected residents and state AGs (California, New York, and others have specific templates). Draft notices with counsel — wording errors trigger separate enforcement actions.

  5. Document remediation and post-mortem actions

    • File the post-mortem with root cause, contributing factors, and dated remediation items. Retain for at least 3 years — regulators and cyber insurers will request it for any subsequent claim.