Data Deletion for B2C Commerce and Commerce Marketplace

Many data protection and privacy regulations can require you to delete shoppers’ personal data when customers request it, or when it’s no longer necessary to keep. We’ve listed a few of the regulations that are important to many companies collecting and processing their customers’ data.

• General Data Protection Regulation (GDPR), European Union
• Personal Information Protection Act (PIPA), Japan
• Privacy Act, Australia
• Personal Information Protection and Electronic Documents Act (PIPEDA), Canada

If you have shoppers who want the data that you've collected on them deleted, or to opt-out of certain types of data sharing, review these common requests and the procedures related to them.

Common Shopper Request	Actions to Consider	Things to Consider
I want you to delete my data from the system after my account is deleted.	Delete all data associated with the customer, as shown in this table.	When you delete a customer, you delete certain associated data. See Deleting Customers. All other data deletion requires extra steps, as noted in this table. See Browser-Based Local Data Storage to consider whether to inform the shopper of any browser cookies that exist on their computer.
I want you to delete my order history.	Delete an order	Set up automatic order removal after a set number of days using the Order Retention setting. The shopper may need to keep certain data to fulfill their obligations under tax and other laws.
I want you to delete any guest baskets I create.	Set basket lifetime for unregistered guests	The system deletes guest baskets after 240 minutes by default.
I want you to delete any custom object containing my personal data.	Delete Custom Objects	The merchant creates and maintains custom objects that can contain personal data. Verify this using the Custom Object Editor in Business Manager.
I want you to delete my personal information from all gift certificates.	Remove customer data from gift certificates	Gift Certificates contain the email of a recipient. Either remove the recipient's email or delete the entire Gift Certificate. If you delete the entire Gift Certificate, consider how you will refund the remaining balance.
I want you to delete my personal information from redeemed coupons.	Delete email addresses from redeemed coupons	Remove email addresses from redeemed coupons using the Forget Email feature.
I want you to delete any lingering cookies or data objects.	Instruct customers to delete cookies and objects from their browsers.	The process to delete cookies and objects depends on the browser the shopper is using. Instruct shoppers to refer to the documentation for their browser.
One of my shoppers in California asked that we not sell her data to other companies.	Consider if a third-party integration, built by the customer or otherwise enabled in Commerce Cloud, is within the scope of the request and how you would respond.	Customers should consider if they need to build customizations to pass on the request to vendors.
I need to create a button on my e-commerce website to receive and honor consumer requests to not sell data to other companies.	Customers can create a button with a clear and conspicuous link on their website. It is the customer's responsibility to determine whether a button is needed. The customer and their implementation partner should build this button and any components to address actions described in our Help & Training documentation.	Customers should consider, through customization,  how they can track the request and their responses to them.
I want you to delete information stored in my local browser sessions.	Browser-Based Local Data Storage	Commerce Cloud uses browser cookies and session storage objects to store and track information. This information can exist on machines with browsers running Commerce Cloud merchant applications, or with browsers accessing websites that run on Commerce Cloud.