A Shopify–NetSuite integration moves customer names, emails, phone numbers, addresses and order history from Shopify into NetSuite, usually through middleware. Under GDPR, your brand is the controller. Shopify, Oracle and the middleware provider act as processors and need data processing agreements. The hardest parts are international transfers, logs and erasure requests that conflict with tax-record retention.
None of this needs to be complicated, but it does need to be designed in rather than added later. This guide walks through what data flows, which lawful basis covers it, which contracts you need and how to handle the awkward cases. It is general information, not legal advice. Data protection obligations depend on your business, your countries and your contracts, so confirm your position with a qualified privacy adviser or your data protection officer.
Key takeaways
- Sync only what NetSuite needs. Fulfilment, invoicing and accounting need far less data than Shopify holds.
- Contract and legal obligation are the usual lawful bases for the core order sync.
- You need a DPA with each processor: Shopify, Oracle NetSuite, the middleware provider and any agency with production access.
- Erasure is not absolute. GDPR lets you keep data you must hold for tax law, but you should still remove or restrict everything else.
- Middleware logs are the most common leak. Full order payloads in logs and error queues are personal data too.
What personal data flows between Shopify and NetSuite?
A typical order sync carries more personal data than people expect. Article 5(1)(c) of the GDPR requires data to be limited to what is necessary, so start by deciding what NetSuite actually uses.
| Data | Needed in NetSuite? | Notes |
|---|---|---|
| Name, billing and shipping address | Usually yes | Fulfilment, invoices and tax reporting |
| Email and phone | Often | Carrier notifications, customer service. Decide per field |
| Order lines, prices, tax, discounts | Yes | The accounting record |
| VAT number and company details | Yes for B2B | Invoices and reverse charge |
| Payment card data | No | Keep card data in the payment provider. Sync transaction references only |
| IP address, browser, session data | Rarely | Fraud tools may use it. NetSuite usually does not need it |
| Order notes and gift messages | Sometimes | Free text can contain anything, including health information |
| Marketing consent | Rarely | Keep in your marketing tools unless NetSuite drives campaigns |
Free-text fields deserve care. If you sell supplements, medical devices or other health-related products, order data can reveal information about someone’s health, which GDPR treats as special category data. Take advice on whether that applies to you.
What is the lawful basis for syncing orders to NetSuite?
For the core sync, the usual bases under Article 6 are:
- Performance of a contract (Article 6(1)(b)) for fulfilling the order, shipping it and handling returns.
- Legal obligation (Article 6(1)(c)) for invoices, VAT records and accounting records you must keep.
- Legitimate interests (Article 6(1)(f)) for things like sales reporting or fraud checks, which need a documented balancing test.
Consent is rarely the right basis for an ERP sync, because the processing is needed whether or not the customer ticks a box. Record each purpose and basis in your record of processing activities under Article 30, and make sure your privacy notice mentions your ERP and integration providers in its description of recipients.
Who needs a data processing agreement?
Article 28 requires a written contract with every processor. For a Shopify–NetSuite stack, that usually means four.
Shopify
The Shopify Data Processing Addendum forms part of the terms you accept. Under it, the merchant is the controller and Shopify is the processor for customer personal data, with exceptions for certain services where Shopify acts as a controller. For merchants in Europe, Shopify International Limited in Ireland is the contracting entity. Shopify publishes its list of subprocessors, which you should review.
Oracle NetSuite
Oracle’s Data Processing Agreement for Oracle Services (version dated 14 August 2025) covers Oracle processing personal information on your behalf, including NetSuite services. Older NetSuite contracts may reference earlier versions, so check which one your order form incorporates.
Middleware
Whether you use an iPaaS such as Celigo, a connector app or a custom service on a cloud platform, the provider stores and processes your order data. You need its DPA, its subprocessor list and its hosting region. For a custom build hosted in your own cloud account, the cloud provider is the processor.
Your integration partner
Any agency or contractor with access to production Shopify, NetSuite or middleware data is processing personal data for you. That includes us when we build and support integrations. Put a DPA in place, and limit production access to the people who need it.
Where is the data stored, and does it leave the EU?
Data residency is about where data sits. Transfers are about where it goes. You need answers to both.
- NetSuite. Oracle’s EMEA data centre fact sheet lists European data centres in Amsterdam, Frankfurt, London and Newport. Your account is provisioned in a specific region. Ask Oracle or check your order form if you are not sure which.
- Shopify. Shopify processes data in several regions through its subprocessors. Its DPA and transfer documentation set out how data is protected when it leaves the EEA.
- Middleware. Many integration platforms offer EU hosting. Choose it at setup, because moving later is harder.
Where data goes to the US, the main mechanism is the EU–US Data Privacy Framework, which covers US companies that have certified under it. The EU General Court upheld the framework in September 2025, and an appeal to the Court of Justice was pending at the time of writing. Standard contractual clauses remain the fallback. Check each US provider on the Data Privacy Framework list, and keep your transfer documentation current in case the position changes. UK businesses follow UK GDPR and the UK–US data bridge.
How do you handle erasure requests when tax law says keep the records?
This is the question we are asked most. GDPR gives people a right to erasure, but Article 17(3)(b) says it does not apply where processing is needed to comply with a legal obligation. Tax and accounting laws require you to keep invoices and transaction records. HMRC, for example, says to keep VAT records for at least six years, and OSS records must be kept for ten. Retention periods differ by country, so set yours with your adviser.
A workable pattern looks like this:
- Keep what the law requires. Invoices, credit memos and the customer details needed to support them stay in NetSuite for the statutory period.
- Remove or restrict the rest. Clear marketing fields, notes, extra contacts and phone numbers that tax law does not require.
- Clean the copies. Middleware logs, error queues, exports, spreadsheets and NetSuite sandboxes refreshed from production all hold copies.
- Delete at the end of the retention period. Article 5(1)(e) means you cannot keep data forever “just in case”. Schedule a review.
- Reply to the person explaining what you erased and what you kept, and why.
Shopify has its own erasure process for customer data in the store. Apps on the Shopify App Store must also handle Shopify’s mandatory privacy webhooks for data requests and redaction. A private integration may not be bound by that App Store rule, but it is a good pattern: when Shopify signals an erasure, the integration should trigger the matching clean-up in NetSuite and the middleware.
How should middleware handle PII in logs?
Integration logs are useful for debugging and risky for privacy. A log that stores the full Shopify order JSON for every sync holds names, addresses and emails for every customer, often with longer retention and wider access than NetSuite itself.
- Log identifiers, not payloads. Order IDs, NetSuite internal IDs, status and error messages are enough for most debugging.
- Mask what you must keep. If you store payloads for retries, mask emails and phone numbers and limit who can see them.
- Set short retention. Successful sync logs rarely need to live beyond a few weeks. Failed records need to live until they are fixed.
- Lock down access. Use named accounts and role-based access, and remove leavers promptly.
- Watch sandboxes. A NetSuite sandbox refreshed from production holds real customer data. Treat it like production or anonymise it.
Article 32 requires security appropriate to the risk, and Article 33 requires you to notify your supervisory authority of a reportable breach within 72 hours. Knowing exactly where personal data sits in your integration makes both easier. Our Shopify NetSuite integration checklist includes these items, and our article on connectors versus custom builds explains how logging differs between the two.
A short GDPR checklist for the integration
- Map every field that moves from Shopify to NetSuite and drop what you do not need.
- Record purposes and lawful bases in your record of processing activities.
- Collect DPAs from Shopify, Oracle, the middleware provider and your integration partner.
- Confirm the hosting region of NetSuite and the middleware.
- Document your transfer mechanisms for any US-based provider.
- Write an erasure procedure that covers NetSuite, middleware, logs and sandboxes.
- Set retention periods for logs and for NetSuite records, and schedule deletion.
We build these points into our Shopify to NetSuite and NetSuite to Shopify integrations. For wider European context, see our Shopify NetSuite integration guide for Europe, the Europe integration hub and our Germany page, where data protection questions come up early.
FAQ
Is Shopify GDPR compliant?
Shopify offers a DPA and documents its subprocessors and transfer safeguards, but compliance depends on how you use it. As the controller, you are responsible for what you collect, where you send it and how long you keep it.
Can I host NetSuite in the EU?
Oracle lists European NetSuite data centres in Amsterdam and Frankfurt, plus London and Newport in the UK. Check which region your account uses before you rely on EU hosting in your privacy documents.
Do I have to delete a customer’s invoices if they ask?
Generally not, where tax or accounting law requires you to keep them. GDPR’s erasure right does not override a legal obligation to retain records. You should still remove personal data that the law does not require you to keep.
Does the integration partner need a DPA?
Yes, if it has access to personal data in your production systems. That includes agencies that build, monitor or support the integration.
If you want a second pair of eyes on what your integration stores, where and for how long, book a free NetSuite Shopify integration assessment. We will trace the personal data in your current flow and suggest practical changes.
