Which Shopify apps need a DPA? Article 28, explained

Short answer: for this purpose, every app connected to your store falls into one of two boxes — it either needs a DPA, or it doesn’t. Most are processors — they handle your customers’ personal data on your instructions, and UK GDPR Article 28 says you need a written Data Processing Agreement (DPA) with each one. A smaller number decide their own purposes for the data, which makes them a controller in their own right — independent, or in some cases a joint controller with you — and a DPA isn’t even the right document to ask for. Mixing these up is how stores end up with the wrong paperwork, or none at all.

What a DPA actually is, and why Article 28 cares

A Data Processing Agreement is the contract that governs what a third party is allowed to do with the personal data you hand it. Article 28 says you may only use a processor that offers “sufficient guarantees”, set out in a binding contract covering things like security, sub-processors, and what happens to the data when you stop using the app.

In plain terms: if you’re the store, you’re the controller — you decide why and how customer data is used. Most of the apps you plug in are processors, acting on your instructions. The DPA is what makes that processor relationship lawful — lawful processing overall still needs a lawful basis, transparency, security and the rest. Without it, you’re handing customers’ personal data to a company under no agreed obligations, and the accountability stays with you.

Processor or controller — the distinction that decides whether you need a DPA at all

Not every app that touches your customers’ data is a processor. The test isn’t “does it see personal data” — it’s “does it decide what happens to that data, or does it follow your instructions?”

An email marketing tool sending your campaigns, to your list, on your schedule, is squarely a processor — it needs a DPA. A payment provider deciding on its own account how to run fraud checks against your transactions can be acting as an independent controller for that purpose — and some apps are joint controllers with you, sharing the decisions. The right document there is a data-sharing or controller-to-controller arrangement, not an Article 28 DPA. Get the box wrong and you either chase the wrong agreement, or worse, assume none is needed.

Where processors actually hide on a Shopify store

Most of the apps that count are the ones nobody thinks of as “data” apps — they’re just tools.

The pattern repeats: the app was installed to solve a problem, and somewhere along the way everyone forgot it holds a customer list. It’s the same gap behind why a privacy notice quietly drifts out of date against your live app stack — the tools multiply faster than anyone updates the paperwork.

What a lawful Article 28 agreement actually contains

A DPA isn’t a formality — Article 28 sets out specific terms it has to cover.

Honest note: whether a given app is a processor, a joint controller, or an independent controller isn’t always a clean call — it depends on what that specific app actually does with the data, not just its category. This guide gets you the general shape right; a genuinely contested case (a payment provider, a marketplace integration, anything doing its own profiling) is worth checking against the ICO’s own guidance or with a specialist. It’s guidance, not a verdict on your specific app stack.

Run this against your own app list

Day to day, this isn’t really a legal question — it’s an inventory question: which apps are connected, which of them process data on your instructions, and where the signed agreement for each one actually is. That’s the same discipline that makes a data protection complaint or a subject access request — where a processor has to help you find the data within the one-month deadline — a routine task rather than a scramble.

What being covered actually buys you

The point isn’t fear of a fine — it’s not carrying exposure you can’t see. A signed DPA means a processor’s breach doesn’t automatically become your unmanaged risk, and a clean inventory is what a payment partner, an investor, or a marketplace due-diligence form actually asks for. It’s the same readiness that underpins the wider GDPR picture for a UK Shopify store — one place where you can always answer “which apps process data, and do we have an agreement” without a scramble.

Want to see which of your connected apps might need one? The free public check looks at your storefront in about 30 seconds — no login, read-only.

The bottom line

Most apps that touch your customers’ data are processors, and Article 28 means you need a signed DPA with each one — but a handful are controllers in their own right, and that’s a different conversation. The risk isn’t usually the app you remember; it’s the one installed months ago that nobody checked. Keep an inventory, know which box each app sits in, and keep the agreements with it.

Sources

The primary sources behind this guide — check them yourself:

• ICO — Controllers and processors (Article 28)
• ICO — Guide to UK GDPR