Shopify’s Binding Corporate Rules

Binding Corporate Rules (BCRs) are binding data protection policies that are, after extensive consultation, approved by European data protection authorities. The approval of Shopify’s BCRs by these authorities confirms Shopify’s commitment to data protection and provides an appropriate framework for our global data transfers and privacy compliance program.

From time to time, Shopify may also update its BCRs in accordance with its policies and procedures. The links below reflect our most recent BCRs, which took effect on July 8, 2026.

Shopify’s BCRs: Processor Policy
Shopify’s BCRs: Controller Policy

For additional information about Shopify’s approach to transfers of personal data please see our Data Processing Addendum, this section of our Privacy Policy, and the article on Onward transfers of personal data in the Shopify Help Center.