GDPR Data Rights for Magento 2: User Guide

GDPR Data Rights helps you handle consent and personal data requests in Magento 2: consent checkboxes with a consent log, a versioned privacy policy, a privacy tab in My Account, guest order links, a request desk with a reply timer, data packs, anonymisation that keeps your orders intact and retention rules with a dry run.

The module is a tool. It does not make a store compliant with any law by itself: check your policy texts, consent wording, retention periods and processes with your legal adviser.

Requirements

Installation

Set up Composer access to repo.commercegears.com as described on https://commercegears.com/composer-access/, then:

composer require commercegears/module-gdpr
bin/magento module:enable CommerceGears_Core CommerceGears_Gdpr
bin/magento setup:upgrade
bin/magento setup:di:compile            # production mode only
bin/magento setup:static-content:deploy # production mode only
bin/magento cache:flush

On Hyvä, rebuild the theme CSS afterwards (npm run build in your theme's web/tailwind folder). The module registers itself for Tailwind source scanning.

Quick start

1. Stores > Configuration > CommerceGears > GDPR Data Rights > General: set Enabled to Yes.
2. CommerceGears > GDPR Data Rights > Privacy Policies: create your policy (version 1.0) and click Activate.
3. CommerceGears > GDPR Data Rights > Consent Checkboxes: add the boxes you need and choose where they are shown.
4. Open My Account > Privacy Settings on the storefront as a customer and try the download.

Configuration

Stores > Configuration > CommerceGears > GDPR Data Rights.

General

• Enabled: when off, no checkboxes, privacy tab, guest page or policy window are shown and retention rules do not run. Default: No.
• Privacy Tab Introduction: text at the top of My Account > Privacy Settings.
• Privacy Contact E-mail: shown in the privacy tab and on the guest page. Empty: hidden.
• Ask for Password Before Privacy Actions: customers enter their password before they download data, anonymise the account or ask for deletion. Wrong passwords count towards Magento's account lock. Default: Yes.
• Customers Can Anonymise Their Account and Customers Can Ask for Account Deletion: show or hide these actions in the privacy tab. Default: Yes.
• Do Not Anonymise While an Order Is In: order statuses that block anonymisation and deletion. Default: pending, pending payment, processing, on hold and payment review.
• Show Cookie Choices in Privacy Tab: only with CommerceGears Cookie Consent installed. Default: Yes.

Anonymisation

• Replacement Name: used for first names, last names and street lines. Default: Anonymised.
• Replacement E-mail Domain: e-mail addresses become a random address at this domain. Default: anonymised.invalid.
• Keep in Order Addresses: address fields that stay in orders. Default: country and region.
• Review Nickname: product reviews are kept with this nickname. Default: Anonymous.

Requests and E-mails

E-mail sender, whether customers receive e-mails about their requests, whether the shop team is told about new requests and to which addresses (empty: the General Contact address), the extension length (1 or 2 months) and the templates: request received, completed, denied, deadline extended, identity check and new request (shop team). All templates can be copied and changed under Marketing > Email Templates.

Guest Orders

Enabled, how long a link is valid (1 to 168 hours, default 24), how many links one IP address may ask for per hour (default 5) and the access link template.

Privacy Policy

• Ask Signed-in Customers to Accept: Never; After a new version, if they accepted an earlier one (default); or Until they accept the current version.
• Policy Change E-mail Template and Policy E-mails per Cron Run (default 50, cron every 5 minutes).

Retention Rules

• Mode: Dry run (default) only reports. Live changes data and can only be chosen after a dry run in the last 7 days.
• Inactive Accounts: After Days: accounts without a sign-in or an order for this many days. 0 = rule off.
• Inactive Accounts: Action: create a deletion request (you check each one in the request desk), anonymise the account, or delete it (orders are kept, anonymised).
• Old Orders: Anonymise After Days and Apply To (guest orders only, or guest and customer orders): completed, closed and cancelled orders older than this keep their amounts but lose the personal data. 0 = rule off.
• Records per Run: per rule and night. Default 100.

Logs

Keep Consent Log (days, 0 = keep, default 0) and Keep Action Log (days, default 730). Old entries and expired guest links are removed every night.

Consent checkboxes

CommerceGears > GDPR Data Rights > Consent Checkboxes. Each box has:

• Code: saved with every consent, for example privacy_policy. Do not change it once consents were given.
• Text: plain text next to the box. Write %link where the link should go, for example "I have read the %link".
• Link To: no link, the current privacy policy, a CMS page or another URL, with its link text.
• Show On: Registration, Account information, Contact us, Newsletter sign-up, Checkout.
• Store Views: for a translated text, create one box per store view.
• Required: the form cannot be sent without ticking the box. Boxes are never ticked in advance.
• Position and Active.

On Account information only the boxes the customer has not given yet are shown. The newsletter boxes are added to every form that posts to the newsletter sign-up, including the footer form. Required boxes are checked again on the server, at checkout before the order is placed.

Every consent is written to CommerceGears > GDPR Data Rights > Consent Log: checkbox code and text, location, given or withdrawn, policy version, customer or e-mail, website, store view, date, order number (checkout) and a SHA-256 hash of the IP address.

Privacy policies

CommerceGears > GDPR Data Rights > Privacy Policies. A policy has a version, a store view (or all), a title, a summary of changes and the content. An active version cannot be edited: click Duplicate to create the next version number, edit it and click Activate. The previous version is archived. When you activate, you can queue an e-mail to the customers who accepted an earlier version; the cron sends them in batches.

The policy is shown at /privacy/policy with a list of all versions. Signed-in customers see the accept window according to the setting above. Accepting is written to the consent log.

My Account > Privacy Settings

Customers can:

• download their data as JSON or as a ZIP file with one CSV file per topic;
• see the accepted policy version and give or withdraw each consent;
• see their cookie choices and open the cookie preferences (with CommerceGears Cookie Consent);
• see their privacy requests and cancel an open deletion request;
• anonymise their account straight away (they are signed out afterwards);
• ask for deletion, which creates a request in the request desk.

Guest orders

/privacy/guest asks for the e-mail address and an order number. If they match a guest order, the guest receives a one-time link to a page that lists all guest orders with that address and offers the download and the anonymisation. The link can be opened once (with a button, so e-mail link scanners do not use it up); the page then stays available in that browser until the link expires or the data is anonymised.

Request desk

CommerceGears > GDPR Data Rights > Requests lists all requests with type, status, source, received date and reply-by date (days left). Add Request Received by E-mail records a request you received outside the store, with the date it arrived.

On a request page you can:

• open Data pack: preview and download;
• Pause clock with a message that asks for identity details (the request waits; the paused time is added to the deadline when the customer answers and you resume it);
• Extend deadline once, with a reason;
• Mark as in progress, add internal notes and see the history;
• Mark as completed or Deny request with a note or reason for the customer e-mail;
• approve a deletion or anonymisation request, which runs the anonymisation and closes the request (this also needs the permission Anonymise and Delete Customer Data).

New requests are shown as an admin system message and, if enabled, e-mailed to the shop team.

Data pack and admin actions on a customer

Customers > All Customers > edit a customer > Personal Data (or the data pack button of a request) opens a page with a preview of every section: account, saved addresses, orders (including guest orders with the same e-mail address), shopping baskets, product reviews, wish list, newsletter, consents, sign-in activity and privacy requests and actions. Untick sections you must not hand out and download JSON or CSV (ZIP).

The Anonymise or delete box shows a dry run of what would change. Anonymise replaces personal data in the account and in orders, order addresses, payment details and gift messages, removes saved addresses, saved payment cards, product alerts, wish lists, open baskets and newsletter subscriptions, and refreshes the sales grids. Delete also removes the account; the orders are kept, anonymised and no longer linked to it. Amounts, items and tax never change.

Retention rules

CommerceGears > GDPR Data Rights > Retention Rules shows the current rules, the last dry run and a Run a dry run now button. Switch Mode to Live in the settings only when the dry run shows what you expect.

CLI commands

bin/magento commercegears:gdpr:export <customer ID|e-mail> [--website=1] [--format=json|csv] [--output=file]
bin/magento commercegears:gdpr:anonymise <customer ID|e-mail> [--website=1] [--delete] [--execute [--yes]]
bin/magento commercegears:gdpr:retention [--execute [--yes]]
bin/magento commercegears:gdpr:log:clean [--consent-days=N] [--action-days=N]

Without --execute, anonymise and retention only show a dry run.

Permissions

System > Permissions > User Roles > Role Resources > CommerceGears > GDPR Data Rights: View Requests, Create and Process Requests, View and Download Customer Data, Anonymise and Delete Customer Data, Consent Checkboxes, Privacy Policies, Consent Log, Action Log, Delete Log Entries, Retention Rules, Settings.

Troubleshooting

• No checkboxes or privacy tab: check General > Enabled for the store view, that the boxes are active for the store view and the location, and flush the cache.
• Policy window does not appear: the customer must be signed in and, in the default mode, must have accepted an earlier version. A new version only appears after you activate it.
• Customer cannot anonymise: an order is still in one of the blocking statuses; the privacy tab lists it.
• Live mode cannot be saved: run a dry run first (Retention Rules page or CLI).
• No e-mails: check Stores > Configuration > Advanced > System > Mail Sending Settings and the template settings.

Uninstall

bin/magento module:disable CommerceGears_Gdpr
composer remove commercegears/module-gdpr
bin/magento setup:upgrade

The tables commercegears_gdpr_* stay in the database with your consent log and request history. Remove them yourself if you no longer need these records.