# Shopify protected customer data requirements, explained

> What Shopify counts as protected customer data, the Level 1 and Level 2 requirements, when Shopify reviews your request, and how to get ready.

Source: https://www.the-meridian.ai/blog/shopify-protected-customer-data

[All articles](https://www.the-meridian.ai/blog)

Security

## Shopify's protected customer data requirements, explained

What Shopify counts as protected customer data, the Level 1 and Level 2 requirements, when Shopify reviews your request, and how to get ready.

If your Shopify app reads customer data, such as orders or customer records, Shopify expects you to protect it in specific ways before it gives you access. The rules come in two levels. This guide explains what they cover, when Shopify reviews them, and how to get ready.

### What counts as protected customer data

Shopify defines it as data that directly relates to a customer or prospective customer. In the API, that means resources such as customers, orders, fulfillments and gift cards, and the webhooks that carry them.

Within that data, four fields need a second level of access:

- Name: first and last names.
- Address: both address lines, geolocation and zip codes, in billing and shipping addresses.
- Email.
- Phone.

Access to customer data in general is Level 1. Access to any of those four fields is Level 2, and comes with more requirements.

### How you request access, and when Shopify reviews it

You request access from your app in the Partner Dashboard, under API access requests, then Protected customer data access. You choose the data you need and explain why, select any Level 2 fields one by one, and complete the data protection details. Shopify asks you to choose a distribution method for your app first, even to test on development stores.

| Where the app runs | Review | What it means |
| --- | --- | --- |
| Development stores | No review | Access is granted once you complete the request. |
| Public apps | Reviewed | Both Level 1 and Level 2 are reviewed when you submit the app. |
| Custom apps | No review | Level 1 and Level 2 are always available. |

Until access is approved, the protected fields come back empty. The API returns null for them, and a GraphQL query answers with an error such as “This app is not approved to access the Customer object”. Make sure your app handles that before you submit it.

> Shopify will approve your app to use protected customer data if the requested data is the minimum amount required by your app to provide the merchant with the app functionality.

Shopify, Protected customer data

### The Level 1 requirements

These apply to every app with access to protected customer data. Most of them are about what your app does with the data, so they are yours to meet whatever your hosting.

| Requirement | Shopify's wording |
| --- | --- |
| 1\. Minimum data | Process only the minimum personal data required to provide app functionality to merchants. |
| 2\. Transparency | Inform merchants what personal data you process and your reason for processing it. |
| 3\. Purpose | Limit your processing of personal data to the stated purposes. |
| 4\. Consent | Where applicable, respect and apply customer consent decisions. |
| 5\. Opt-out of sharing | Where applicable, respect and apply customer decisions to opt out of any data sharing such as a 'data sale' or similar concept under applicable laws or regulations. |
| 6\. Automated decisions | If you use personal data for automated decision-making and those decisions might have legal or significant effects, then you must allow customers to opt out. |
| 7\. Agreements | Make privacy and data protection agreements with your merchants. |
| 8\. Retention | Apply retention periods to make sure that personal data isn't kept for longer than needed. |
| 9\. Encryption | Encrypt data at rest and in transit. |

### The Level 2 requirements

These apply on top of Level 1 once your app reads names, addresses, emails or phone numbers. Several of them depend on how your app is hosted and run.

| Requirement | Shopify's wording | In practice |
| --- | --- | --- |
| 1\. Backups | Encrypt your data backups. | Ask your host whether backups are encrypted, and get it in writing. |
| 2\. Separation | Keep test and production data separate. | A development environment with its own database, never a copy of production. |
| 3\. Data loss | Have a data loss prevention strategy. | Automated backups, a retention you can state, a tested restore. |
| 4\. Staff access | Limit staff access to protected customer data. | Roles per person and per app, removed when someone leaves. |
| 5\. Passwords | Require strong passwords for staff accounts. | Two-factor sign-in or single sign-on for everyone. |
| 6\. Access log | Keep an access log to protected customer data. | A record of who reached the data, when and how. |
| 7\. Incidents | Implement a security incident response policy. | A written plan: who decides, who tells merchants, how fast. |

**Good to know.** Requesting fewer fields is the simplest way through review. If your app only needs an order total, it does not need the customer’s name or address.

### How to get ready

1.  List every customer field your app reads, and the reason for each one.
2.  Remove what you do not need, starting with the Level 2 fields.
3.  Tell merchants what you process and why, in your privacy policy and in your data agreement with them.
4.  Set a retention period for each kind of data, and delete it on schedule.
5.  Check your hosting against Level 2: encryption, separate environments, backups, roles, sign-in, access logs. Ask for the answers in writing.
6.  Write your incident response policy before you need it.
7.  Handle empty protected fields in your app, so it keeps working while a request is under review.

Apps on the Shopify App Store must also handle Shopify’s mandatory compliance webhooks, which ask your app to send or delete a customer’s data, and to delete a store’s data after it uninstalls your app.

### Where Meridian fits

Meridian hosts Shopify apps, so it covers part of the Level 2 list for the apps it runs. Development and Production are separate environments, each with its own database and secrets. Production databases are backed up daily. Every collaborator has a role by organization and by app, the database sits on a private network, and two-factor sign-in is available on every plan, with single sign-on on Enterprise. On Enterprise, an activity log records changes, support sessions and backup downloads.

What your app does with customer data stays with you: the Level 1 requirements, your app’s own access logging, and your incident response policy. The Trust Center sets out, requirement by requirement, what Meridian covers and what stays with your app.

[See the Trust Center](https://www.the-meridian.ai/trust#shopify-requirements) [Read Shopify's requirements](https://shopify.dev/docs/apps/launch/protected-customer-data)

Source: Shopify’s [protected customer data documentation](https://shopify.dev/docs/apps/launch/protected-customer-data), checked on 10 October 2026. Shopify updates its requirements, so check the page before you submit your app.

### Ready to ship your next Shopify app?

Book a personal walkthrough of Meridian.

[Schedule a demo](https://www.the-meridian.ai/contact-sales) [Start building](https://app.the-meridian.ai/register)