GDPR on Magento Open Source: What's Missing Out of the Box

A shopper writes: “Send me everything you have on me” or “Delete my account.” The GDPR gives you one month to answer, with two more months only where necessary, under article 12(3). Magento Open Source has no button for either request. Adobe's own GDPR guide suggests developers write scripts for the case where a shopper asks to delete their information.

Romania's data protection authority, ANSPDCP, fines for this. In September 2025, a company was fined 5,057.8 lei, 1,000 euros, for refusing an erasure request. In January 2026, another was fined 10,178 lei, 2,000 euros, after a customer asked for erasure several times and got no answer. After GPSR and Omnibus, this is the third EU rule Magento doesn't cover out of the box.

5 requests, and what Magento does with each

• Article 15, a copy of their data: Magento has no download. Someone collects the account, addresses, orders and newsletter status by hand.
• Article 17, erasure: shoppers can't delete their own account from My Account. Only the admin can, and the orders keep the address.
• Article 18, restricting processing: there is no state that pauses a single account.
• Article 20, their data in a file: there is no export for the shopper.
• Article 21, no more marketing: the newsletter unsubscribe exists. For SMS or any other channel you use, there is nothing.

Delete the customer, the orders stay

When an admin deletes a customer, Adobe's documentation says information about their activity and transactions is retained in the system. In the database the order only loses its link to the customer. The order address, with name, phone, email and street, stays. Adobe's list of personal data shows it, among other places, in the order and order address tables, the order grid and the quotes.

Part of it has to stay: the invoice data. The rest has to go, and Magento doesn't separate the two.

What you keep: the invoice, 5 years

Since 15 January 2023, through Law 36/2023, article 25 of Romania's accounting law 82/1991 requires 5 years of archive for accounting registers and supporting documents. The 5 years count from 1 July of the year after the financial year closes. Payroll falls under the same rule, and the old 50 years for payroll are gone. Many checklists still say 10 years.

GDPR allows this: article 17(3)(b) sets aside data the law requires you to keep. So erasure has two deadlines. The account, saved addresses and marketing data go within one month. The invoice and the data on it stay until the 5 years end.

In the example, the order is from 15 March 2026. The financial year closes on 31 December 2026, the 5 years start on 1 July 2027 and end on 30 June 2032. The shopper asks for erasure on 10 May 2027, so the account has to go by 10 June 2027. The invoice stays another 5 years.

Consent you can prove

Article 7(1) says that when you process data on the basis of consent, you must be able to show the person gave it. Magento's sign-up form doesn't ask for consent to your terms, so you have no proof. Article 7(3) requires withdrawing consent to be as easy as giving it.

What to check this week

1. Send a test request to your store's contact address: “I'd like a copy of my data.” Note how many days the answer takes and who handles it.
2. Delete a test customer in the admin, then search the order grid for their email. If it shows up, the order address is still there.
3. Ask your accountant which documents you keep and from which date: 5 years, from 1 July of the year after the financial year closes.
4. Open your sign-up form. Can you show what a customer agreed to, and when?
5. Count your marketing channels: newsletter, SMS, push. Each one needs a way out.

How we solve it on Magento and Hyvä

We built our own GDPR modules for Magento Open Source and Hyvä: a data download for the shopper, erasure that keeps what the accounting law requires, account deletion from My Account, marketing preferences per channel and proof of consent at sign-up. Proof of consent already ships in Liquid Framework, and the others join the Framework at no extra cost.

This post is not legal advice. The official texts are linked above: the GDPR, Law 82/1991 in its consolidated form and Law 36/2023.

Want to know how long a data request would take on your store? Book a free strategy call. We'll walk through one request together, from start to finish.