GDPR compliance for a Magento store is part platform configuration, part operational process, part documentation. Magento provides real tooling - consent checkboxes, data export and erasure flows - but the platform alone does not make you compliant. Here is the practical checklist we run for UK and EU-facing stores, in the order that matters.
Lawful Basis and Consent
The two touchpoints that collect consent:
- Account registration and checkout: marketing consent must be unticked by default and granular - pre-ticked boxes are not consent. Magento’s newsletter checkbox is configurable; make it explicit
- Cookies and tracking: a real consent management platform (CMP) - not a decorative banner. Non-essential cookies (analytics, advertising pixels) must not fire before consent. Google Consent Mode v2 integration is now the de facto requirement for stores using Google Ads: consent signals must flow to tags, or your remarketing audiences silently die - and firing anyway is unlawful
The CMP must also log consent: who, when, what they agreed to. “We think they consented” fails an ICO complaint.
Data Subject Rights in Magento
Magento has built-in tooling for the two big rights:
- Right of access (DSAR): customers can be exported via the admin (Customers > Actions > Export) including orders, addresses and account data. Turnaround target: the statutory one month, so have the process written down
- Right to erasure: Magento’s “Delete” for customers anonymises order data while retaining the financial records you must legally keep - orders are retained with personal identifiers stripped. Understand this nuance: you cannot delete the tax record, you can delete the person
For Adobe Commerce, the Privacy and Cookie settings plus the data subject request handling are more complete; on Open Source, some merchants add a dedicated GDPR extension to cover guest orders and newsletter subscribers cleanly.
Data Map and Retention
You cannot protect or delete what you have not catalogued. Document:
- Where personal data lives: Magento (customers, orders, quotes, newsletter), plus the systems Magento feeds - email platform, ERP, analytics, review tools, support desk
- Retention periods: how long quotes, abandoned carts and logs are kept, and the job that purges them (Magento’s built-in logs and abandoned quote cleanup are configurable)
- Who processes it: your DPAs with hosting, email and analytics providers
The forgotten corners we find in audits: server access logs with IPs, database backups kept forever, staging databases holding a copy of the production customer table with no controls.
Security as Compliance
GDPR requires “appropriate technical measures”. In Magento terms that means: admin 2FA, least-privilege admin roles, patched platform and extensions, encrypted transport everywhere, and access logging. A breach of an unpatched store is not just an incident - with known-unpatched software it approaches negligence in a regulator’s eyes.
The Practical Minimum
- Real CMP with Consent Mode v2, consent logging, unticked-by-default marketing
- Privacy policy written for your data flows, not a template
- Documented DSAR and erasure procedure, tested once
- Data map including third parties and retention periods
- Patching and admin security treated as compliance work
None of this is exotic, and most of it is process rather than purchase. The stores that get GDPR right treat it as ongoing operations - annual review, new-tool review, breach drill - not a project that finished in 2018.