GDPR and sharing customer data in disputes: what UK Shopify merchants can send

A chargeback arrives and you start pulling evidence: the buyer's name, address, email, phone, IP address, messages, maybe a photo of them holding the parcel. Somewhere in the middle of that you wonder whether you are allowed to send all of it to a card company, and whether you should.

Sharing customer data in disputes is normal and lawful when you keep to what the dispute needs, tell people what you do and look after what you keep. This guide sets out, in plain English, how UK GDPR thinking applies to a Shopify chargeback response: what to include, what to leave out, how to redact, how long to keep records, how to handle a subject access request mid-dispute and what to tell customers, with templates, worked sums and a day-by-day plan.

Last updated: 9 October 2026. Written by the ChargeFix team.

The 30-second answer (TL;DR)

• Sharing customer data in disputes is a normal part of defending a payment. A chargeback response needs order, delivery and contact details, so sharing customer data in disputes should cover what answers the reason and no more.
• Data minimisation is the working rule for sharing customer data in disputes: include the facts a reviewer needs, redact the rest, and never include data about other customers.
• Shopify Payments auto-fills order, addresses, tracking, IP, refund records, order history and previous disputes on the response form, according to Shopify's help centre. Review that pre-filled data before you submit.
• When you plan sharing customer data in disputes, tell customers in your privacy notice that you share order and payment information with payment providers, carriers and card companies to process orders and handle disputes. Keep it short and plain.
• Records behind sharing customer data in disputes and consumer claims can outlast the chargeback window: chargebacks usually run to 120 days and Section 75 claims to six years. Set a written retention period and ask an adviser to check it.
• A customer can make a subject access request at any time, including during a dispute. Sharing customer data in disputes and answering that request are separate jobs, so have a short process and a template ready for each.
• General information, not legal advice. We did not review the Information Commissioner's Office guidance in detail or any card scheme data rules, and the post says so where it matters. Ask a data protection adviser to check your policy.

From dispute to decision

Stage	What data is involved	What to do	What to keep
Order	Name, address, email, payment details	Collect only what you need	Order record
Delivery	Name, address, phone for the carrier	Share what the carrier needs	Carrier proof of delivery
Dispute notice	Order and payment details	Log it, set the due date	The notice
Evidence pack	Order data, messages, delivery proof	Include what answers the reason, redact the rest	A dated copy of what you sent
After the decision	Outcome and the pack	Apply your retention rule	The log row and pack, for the period you set
Customer request	A request for their data	Reply within the legal time limit	A record of the request and reply

What does sharing customer data in disputes actually involve?

Sharing customer data in disputes means giving a payment provider and, through them, a card company the information needed to show an order was genuine and fulfilled. That includes order details, addresses, delivery proof and messages. Much of it is already held by Shopify's payment system, and you add the rest.

Walk through the data that moves in a typical chargeback:

Data	Where it comes from	Who sees it	Needed for
Name, billing and shipping address	The order	Shopify, the card company	Showing the order went to the buyer
Email and phone	The order	Shopify, possibly the card company	Showing contact and confirmation
IP address and device details, where recorded	The order	Shopify, the card company	Supporting a genuine purchase
Order history and previous disputes	Shopify Payments	Shopify, the card company	Showing a pattern
Delivery proof with name or photo	The carrier	You, then the card company	Item not received
Messages with the buyer	Your inbox	You, then the card company	Showing contact and offers
Refund records	Your admin	You, the card company	Refund disputes

Shopify's help centre says Shopify Payments auto-fills order, addresses, tracking, IP, refund records, order history and previous disputes on the response form. So some sharing is built into the process. What you add yourself is the part you control: the screenshots, the messages and the notes.

For the card side of how disputes work, read our Shopify chargebacks UK guide. Shopify's help centre explains that Shopify is not liable for chargebacks and that you respond with evidence. Evidence about a person is personal data, which is why this post exists.

We should be clear about the limits of what we can say. We did not review the Information Commissioner's Office guidance in detail, or the data rules of any card scheme, or Shopify's own data processing terms. So we do not give a legal opinion on lawful basis. What we can give you is a practical approach that follows the common data protection principles: be fair, be open, collect and share what you need, keep it safe, and do not keep it longer than necessary. Ask a data protection adviser to confirm how those apply to your business.

What goes into an evidence pack when sharing customer data in disputes?

Include data that answers the stated reason: order record, delivery proof, address match, confirmation email, refund record and relevant messages. Leave out anything unrelated to the dispute, anything about other customers and anything the reviewer cannot use. Redact what you cannot avoid showing.

Start from the dispute reason and ask of each item: does this help a reviewer decide? If not, leave it out. That habit is data minimisation in practice, and it keeps sharing customer data in disputes proportionate.

Item	Include?	Why
Order confirmation with delivery address	Yes	Shows what was ordered and where it went
Carrier proof of delivery with signature or photo	Yes	Answers item not received
Email thread about this order	Yes, trimmed to relevant messages	Shows contact and offers
Full customer record with unrelated notes	No	More than the dispute needs
Another customer's name on a shared screenshot	No, redact	Data about other people
Full card number	Never	Shopify's payment system holds payment details; you do not need to send them
Internal comments about the customer's character	No	Not relevant, and risky
Policy pages with dates	Yes	Shows what the buyer was told

Take screenshots with care. A screenshot of your admin may show other orders, other customers, internal notes and API keys. Crop to the one order, or redact with a solid box. A blurred area can sometimes be reversed, so use a solid fill and save the redacted version, not the original.

Use this checklist before you attach anything:

• Does this item answer the stated reason?
• Is it about this buyer and this order only?
• Have I cropped or redacted other customers' data?
• Have I removed internal notes that do not belong?
• Have I removed any full card number or login details?
• Have I kept a dated copy of exactly what I sent?
• Is the file readable after redaction?

If the dispute concerns sensitive goods, such as health products, the messages may contain health details. The chargeback reviewer may not need those. Include only the part that shows the product was as described or delivered, and consider whether to describe the point in your summary instead of attaching the full message. Our posts on supplements and health products cover this in more depth.

What does UK GDPR mean for sharing customer data in disputes?

In plain words, UK GDPR thinking for sharing customer data in disputes comes down to this: use data fairly and for a clear purpose, collect and share only what you need, keep it accurate and safe, and delete it when you no longer need it. Handling a dispute is a clear purpose, and a short privacy notice tells customers that you do it.

This section is general information, not legal advice. We did not review the regulator's guidance in detail. It lists the principles in everyday language so you can check your own practice of sharing customer data in disputes against them, including the UK GDPR idea of data minimisation.

Principle in plain words	What it means for disputes	What to do
Fair and open	Customers should not be surprised that you share order data to handle disputes	Say so in your privacy notice
Clear purpose	You use the data to process orders and defend payments	State those purposes
Only what you need	Include the facts that answer the reason	Use the pack checklist
Accurate	Wrong data in a pack can cost you the case	Check names, dates and addresses
Not kept longer than needed	Keep records for a stated period, not forever	Set a retention schedule
Kept secure	Evidence packs hold personal data	Use access controls and a tidy folder structure

The lawful basis for sharing data in a dispute is a legal question we have not reviewed. Many businesses rely on their need to perform the contract and on their legitimate interests in defending payments. Whether that fits your situation is something an adviser should confirm. Do not rely on this post for that decision about sharing customer data in disputes.

Two practical points about sharing customer data in disputes follow from the principles:

1. Do not share customer data for a purpose the customer would not expect. Using dispute evidence for marketing, for example, is not a dispute purpose.
2. Do not keep full evidence packs indefinitely. Decide how long you need them and delete or archive after that.

What should your privacy notice say about disputes?

Say that you share order and payment information with payment providers, carriers and card companies to process orders, prevent fraud and handle disputes and refunds. Say how long you keep records. Say how customers can contact you about their data. Keep it short, plain and dated. A good privacy notice makes sharing customer data in disputes unsurprising to the customer.

A privacy notice does not need a paragraph on every possible data flow. It needs the ones customers would reasonably want to know about. Disputes are one of them.

Use this wording as a starting point and have it checked:

HOW WE USE YOUR INFORMATION FOR PAYMENTS AND DISPUTES
Version [NUMBER], effective [DATE]

When you place an order, we collect your name, contact details, delivery address and payment information. We use them to process your order, deliver it, take payment and give you customer service.

We share what is needed with our payment provider, our delivery carriers and, if a payment is disputed, with the card company or bank reviewing it. In a dispute, this may include your order details, delivery address, proof of delivery and our messages with you. We share only what is needed to show what happened.

We keep order and payment records for [NUMBER] years so we can handle refunds, disputes and legal claims, and then delete or anonymise them.

You can ask us for a copy of your information, ask us to correct it or, in some cases, ask us to delete it. Email [EMAIL] and we will reply within the legal time limit. You can also complain to the Information Commissioner's Office.

Contact: [NAME / ROLE], [EMAIL]

Three notes on this template:

• The retention period needs a reason. "Six years" matches the Section 75 limit UK Finance gives, but your adviser may set a different period. Do not copy a number without thinking.
• The line about the regulator is a courtesy, and it fits common practice. Check wording with an adviser.
• Link the notice from the footer and the checkout, and keep a dated copy. If you change it, say what changed.

Our terms and conditions template and shipping and delivery policy template cover the other pages a reviewer may read. A privacy notice is separate from both, and mixing them makes each harder to cite. Only the privacy notice needs to explain sharing customer data in disputes.

How long should retention last for dispute records?

Keep them as long as you may need them for disputes, refunds and legal claims, and no longer. Chargebacks are usually claimed within 120 days, Section 75 claims can run for six years on credit card purchases of £100 to £30,000, and refunds on some payment methods can run longer. Set the period in writing and justify it.

Different records have different reasons, and sharing customer data in disputes only makes sense while a record is still needed. Use a schedule like this as a starting point, then ask your adviser to set your own periods.

Record	Why you might need it	Possible keep period	Notes
Order and payment record	Refunds, disputes, accounts	Six years, per your accountant and adviser	Accounting rules may set a minimum
Delivery proof	Item not received, Section 75	Match the order record	Save early, as carriers may remove tracking
Messages with the buyer	Disputes and complaints	12 months after the last message, or longer if a dispute is open	Review at renewal
Evidence pack for a dispute	The dispute and appeal	Until the outcome plus your chosen buffer	Keep the dated copy of what you sent
IP and device logs	Fraud checks	Shorter than the order record	Keep only if useful
Customer record for marketing	Newsletters	Until the customer unsubscribes	Separate from dispute records

The figures in the "possible keep period" column are suggestions to discuss, not legal rules. We did not review the regulator's retention guidance. What matters is that you pick a period for a reason, write it down and apply it.

Two tensions are worth naming. First, a longer record helps you defend a late claim, such as a Section 75 claim years after a purchase. Second, a longer record is also more data held. A sensible compromise is to keep the order and delivery record for the claim period and delete the rest sooner.

On payment methods with long refund windows, such as bank payments, where Stripe's documentation says refunds can be made for up to 730 days, keep the order record at least that long. Our post on Pay by Bank chargebacks covers that.

What if a customer sends a subject access request during a dispute?

Reply within the legal time limit, provide what you must and keep the dispute going in parallel. A subject access request is a request for personal data, and it is separate from a chargeback. Do not delay your chargeback response, and do not ignore the request.

We did not review the exact time limit, the exceptions or the charging rules, so ask an adviser. In general terms, a person can ask an organisation for a copy of the personal data it holds about them. A request can arrive by email, by letter or by any other route, and does not need a special phrase.

Use this process:

1. Log the request with the date received and the person's name.
2. Confirm who is asking. If you are unsure, ask for proof of identity in a proportionate way.
3. Find the data: order records, messages, delivery records, dispute packs, notes.
4. Check for anything you must not disclose, such as other people's data.
5. Reply within the legal time limit, with a clear copy and a short explanation.
6. Log the reply and what you sent.

Here is a short acknowledgement you can adapt:

Hi [FIRST NAME],

Thanks for your email of [DATE]. We have received your request for a copy of the personal information we hold about you.

We will reply within the legal time limit, which runs from [DATE]. To help us find everything, please tell us the email address and order numbers you used. If we need proof of identity, we will let you know.

[NAME / ROLE]
[STORE NAME]

If the request comes from a person who has also filed a chargeback, treat them as two separate matters. Your chargeback response is due on its own date. Do not mention the chargeback in the data reply unless it is relevant to what you hold. And do not accuse the person of using the request to apply pressure. A request is a right, not a tactic.

Can you share customer data with a carrier or a tool when sharing customer data in disputes?

Yes, when it is needed to deliver the order or prove delivery. Sharing customer data in disputes with a carrier or tool follows the same rule of need. A carrier needs a name, address and often a phone number. A tool that helps you build responses may also handle order and delivery data. Check the data terms of any provider, and make sure the privacy notice covers the sharing.

When a third party handles personal data for you, they are usually acting on your behalf, and the arrangement should be in writing. We did not review the details, so ask an adviser what terms you need with a carrier, a payment provider or a tool.

Questions to ask any provider that touches dispute data, including a response tool:

• What personal data do you receive from us, and why?
• Where is it stored, and for how long?
• Who at your company can see it?
• Do you use it for anything other than our service?
• Do you share it with anyone else?
• What happens to our data if we leave?
• Do you have written terms that cover our responsibilities?
• How do we ask you to delete or return data?

We say "including a response tool" on purpose. If you use ChargeFix or any other tool, review its terms in the same way. We have not described any provider's data practices in this post, and we do not make claims about them.

For carrier proof of delivery, ask the carrier what data its proof shows. Royal Mail captures a photo on delivery for Tracked 24 and Tracked 48 where no signature is needed. Evri offers a Digital Signature add-on with photographic proof, at 60p when we checked, and the price may change. We have not verified DPD's proof options. A photo of a doorstep may show a house number or a vehicle. Think before you attach it, because sharing customer data in disputes includes photos, and crop what the reviewer does not need. Our guide to proof of delivery for Shopify chargebacks explains what each kind of proof shows.

What does careful sharing of customer data in disputes cost? Two worked examples

A little, if you build it into the routine. Sharing customer data in disputes carefully costs minutes per case, not days. The examples below show the time cost of a redaction step and of answering a request. Run the sums with your own times.

Both examples are illustrations with invented numbers. The arithmetic is checked.

Example 1: a redaction step in the pack. A store handles 20 disputes a year. Redacting by hand, from scratch each time, takes 12 minutes a dispute. With a saved pack template that lists what to include and a standard crop, it takes 4 minutes. Time is valued at £25.00 an hour.

Case	Minutes per dispute	Total minutes	Hours	Cost at £25.00 an hour
Redact from scratch	12	20 × 12 = 240	4.0	£100.00
Use a template	4	20 × 4 = 80	1.33	£33.33
Saving		160	2.67	£66.67

The template saves £66.67 a year on these invented numbers, and a more consistent result. The bigger value is fewer mistakes, since a rushed screenshot is the one that shows another customer's name.

Example 2: a standard process for requests. A store receives 3 requests for personal data a year. Handling each from scratch takes 2 hours. With a checklist and templates it takes 45 minutes. Time is valued at £25.00 an hour.

Case	Hours per request	Total hours	Cost
From scratch	2.0	3 × 2.0 = 6.0	£150.00
With a checklist	0.75	3 × 0.75 = 2.25	£56.25
Saving	1.25	3.75	£93.75

A checklist saves £93.75 a year here. The numbers are assumptions, and they ignore the value of getting a request right. Missing a legal time limit is the real cost, and we did not review the consequences, so ask your adviser.

Situation	Suggested move	Reason
Dispute pack with other customers visible	Redact before sending	Data about other people
Request for data during a dispute	Handle separately and on time	Two different matters
Unsure what to include	Include what answers the reason, leave the rest	Data minimisation
New tool that touches dispute data	Read its terms first	You remain responsible for your customers' data
Retention period unclear	Set one in writing and have it checked	A reason beats a guess

Day-by-day plan: sort sharing customer data in disputes in a week

You can have a sensible routine for sharing customer data in disputes in a week, an hour or two a day. The plan below covers the notice, the pack, the schedule, the request process and a check by an adviser.

Day	Task	Output
Day 1	List the systems that hold customer data: Shopify, email, carrier accounts, tools, spreadsheets	A data map
Day 2	Draft your privacy notice paragraph on payments and disputes	Draft text
Day 3	Write the evidence pack checklist and a redaction rule	A one-page checklist
Day 4	Set a retention schedule and reasons	A written schedule
Day 5	Write the request process and the acknowledgement template	A short process
Day 6	Review the terms of carriers, payment providers and any tools	A gap list
Day 7	Send your drafts to an adviser, then publish the notice	A checked notice and process

Our chargeback SOP for small teams gives the routine to run alongside this plan. Add the pack checklist as a step before submission, so sharing customer data in disputes is checked every time.

Shopify's help centre says nothing can be added after the due date and the result is final, and we did not verify whether a submitted response can be edited. So run the redaction check before you submit, not after.

Quick rules for sharing customer data in disputes and data minimisation

Keep these near your desk. They sum up how to keep sharing customer data in disputes fair, small and tidy.

1. Start from the reason. Sharing customer data in disputes should answer the reason code and nothing beyond it.
2. Apply data minimisation: if an item does not help a reviewer decide, leave it out.
3. Redact other people. Sharing customer data in disputes never includes data about other customers.
4. Tell customers. Your privacy notice should say that sharing customer data in disputes happens, and why.
5. Set retention. Decide how long you keep each record, write the reason down and apply it.
6. Separate the jobs. A subject access request and a chargeback have different clocks, so log both.
7. Keep a dated copy of exactly what you sent, so you can show later what sharing customer data in disputes actually involved.

Question	Quick answer
Can I send the buyer's address?	Yes, if it answers the reason
Can I send other customers' details?	No, redact them
Can I keep the pack for ever?	No, set a retention period
Does UK GDPR stop me defending a payment?	Not by itself, but ask an adviser about your case

What's different for UK merchants

This section is general information, not legal advice.

• Data protection: UK GDPR and the Data Protection Act 2018 apply to sharing customer data in disputes and to the personal data in dispute evidence. We did not review the regulator's guidance in detail, so ask a data protection adviser to check your practice.
• Shopify: Shopify's help centre says Shopify Payments auto-fills order, addresses, tracking, IP, refund records, order history and previous disputes on the response form. Review the pre-filled data before you submit.
• Time limits: MoneyHelper describes chargeback as a voluntary card-scheme arrangement, usually claimed within 120 days. UK Finance gives the same period, counted from the transaction or the expected delivery.
• Section 75: for credit card purchases between £100 and £30,000, the card company is jointly liable with the merchant. UK Finance says the time limit is six years, which affects how long you may need records.
• Fees: Shopify's UK fee for card chargebacks is £10, charged by your bank and returned if you win.
• Consumer rights: the Consumer Contracts Regulations 2013 give most distance buyers a 14-day cancellation right, with a refund due within 14 days of getting the goods back or evidence of return.
• Shopify Protect: it does not cover UK stores, so your evidence and your data practice are your own protection.
• Weekends and bank holidays: we did not verify how they affect due dates. Respond early.

Common mistakes

1. Sharing customer data in disputes that goes beyond the reason, such as attaching screenshots that show other customers' names, addresses or orders.
2. Sending the full email thread when only two messages matter.
3. Including internal notes about the customer that you would not want them to read.
4. Keeping packs of shared customer data in disputes for ever with no stated reason or period.
5. Having a privacy notice that says nothing about sharing customer data in disputes.
6. Ignoring a subject access request because a chargeback is also open.
7. Using dispute evidence for marketing or any purpose beyond the dispute.
8. Adopting a tool or carrier service without reading how it handles customer data.

FAQ

Can I share customer data in a chargeback response?

Yes. Sharing customer data in disputes is normal when it is limited to the facts a reviewer needs to decide, which are part of defending a payment: order details, delivery address, proof of delivery and relevant messages. Include only what answers the dispute reason and redact the rest. Tell customers in your privacy notice. Ask an adviser to confirm the lawful basis for your business.

What customer data should I leave out of a dispute response?

Leave out anything that does not answer the reason, anything about other customers, internal notes about the buyer, full card numbers and login details. Crop or redact screenshots with a solid fill. Shopify Payments pre-fills some data, so review it before you submit.

Does UK GDPR apply to chargeback evidence?

Evidence about a person is personal data, so UK GDPR and the wider data protection rules apply to sharing customer data in disputes. We did not review the regulator's guidance in detail, so this is a plain-English reading, not legal advice. Ask a data protection adviser how it applies to your records and your tools.

How long can I keep dispute records?

Only as long as you need them, and for a stated reason. Retention should cover the period in which sharing customer data in disputes may still be needed. Chargebacks usually run to 120 days, and Section 75 claims on credit cards to six years. Set a written schedule, justify each period and ask an adviser to check it. Do not keep evidence packs indefinitely.

What should my privacy notice say about disputes?

Say that sharing customer data in disputes is part of how you work: you share order and payment information with payment providers, carriers and card companies to process orders, prevent fraud and handle disputes and refunds. State how long you keep records and how customers can contact you about their data. Keep it short, plain and dated.

What if a customer sends a subject access request while a dispute is open?

Treat them as two separate matters. Answer the request within the legal time limit and meet the chargeback due date on its own timetable. Log both, and do not mention the dispute in the data reply unless relevant. We did not review the exact limits, so ask an adviser.

Can I send a photo of the parcel at the customer's door?

Often yes, because it is delivery proof, but check what it shows. A doorstep photo can reveal a house number, a vehicle or a person. Crop what the reviewer does not need. Royal Mail captures such a photo on Tracked 24 and Tracked 48 where no signature is needed.

Do I need a data processing agreement with a response tool?

When a tool handles personal data on your behalf, the arrangement should usually be in writing. We did not review the details, and we have not described any provider's terms, including ours. Ask the provider for its terms and ask an adviser what you need.

Should I tell the customer I am sharing their data?

Tell them in your privacy notice before they order, so sharing for disputes is expected. You do not usually need to notify each customer every time a dispute is raised, but ask an adviser how your notice and practice fit together. Never surprise a customer with an unexpected use.

Is it safe to email dispute evidence to a colleague?

Use a secure shared folder with access controls rather than forwarding attachments, and send only what the colleague needs. Keep the pack in one place, name it with the order number and apply your retention rule. Avoid sending packs through personal email accounts.

Start free trial

ChargeFix helps Shopify merchants turn order and delivery evidence into a clear response, so your time goes to the order, not the paperwork. Start free trial and keep your approach to sharing customer data in disputes consistent from the first case.

Sources

• Shopify Help Center: Chargebacks and inquiries
• UK Finance: Chargeback and Section 75
• legislation.gov.uk: Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, explanatory note
• Stripe, Best practices for preventing fraud: further reading on stopping disputes before they start
• Adyen, Manage disputes: further reading on how another payment provider handles disputes